File Integrity Monitoring: definition
File Integrity Monitoring (FIM) is the control that continuously checks whether system files, configurations and other critical elements of a computer have been changed, and flags every unexpected change.
In short
FIM takes a snapshot of the "good" state of important files and then compares it with the current state. If a system file, a configuration or a website page changes without anyone having planned it, an alert goes out with the details: which file, when, what changed and, if available, which user or process changed it.
How it works
- Baseline: for each monitored file a cryptographic fingerprint (hash) is calculated and attributes such as size, permissions and owner are recorded.
- Comparison: at regular intervals, or in real time when the operating system reports a change, the fingerprint is recalculated.
- Alert: if the fingerprint does not match, the event is logged and sent to the central console or to the SIEM.
- Change management: expected changes, such as updates installed through patch management, must be recognised so as not to generate noise.
What is worth monitoring: system executables and libraries, service configuration files, autostart folders, Windows registry keys linked to start-up, folders published by the web server, and configuration files of critical applications. Monitoring everything produces nothing but noise.
Why it matters
Many attacks leave a permanent change: a backdoor on the web server, a service added to survive a reboot, a weakened configuration. FIM is one of the most reliable ways to notice, because it does not depend on recognising the malware: it is enough that something changes. It is also an explicit requirement of standards such as PCI DSS, a useful control for ISO/IEC 27001, and a valuable source for forensic analysis after an incident.
Example
A company's website runs on a hosted server. One morning FIM flags a new PHP file in the folder of images uploaded by users, which appeared at 3:12 a.m. The name looks harmless, but the content is a "web shell", a small program that lets someone send commands to the server from a browser. The alert arrives before the attacker uses it to go further: the file is removed, the vulnerability in the upload module is fixed and the server logs reconstruct how the attacker got in.
Related terms
- HIDS: FIM is often one of its components
- Indicators of compromise (IoC)
- Hardening
- EDR
Where you find it in Dottor Box
The Cyber Agent on PCs and servers includes file integrity monitoring to spot unauthorised changes and a history of changes to the system registry, together with alerts on critical events.
Cyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more SeeManaged SIEM and XDR
Centralised logs, event correlation and endpoint response, with analysts who filter out the noise.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more