Atomic Endpoint Defender File Integrity Manager (FIM) Configuration¶
AED has an advanced file integrity manager built in that will alert you if file changes have occurred on your system.
To access the AED File Integrity Manager, follow this process:
Step 1) Log into the AED Web Console
Step 2) Click on the ‘AED’ tab
Step 3) Scroll down to ‘File Integrity’ and click that option
At this point the file integrity manager will be opened.
If any files have changed that the system is configured to monitor, it will display them in this window under the ‘Files’ tab.
Configuring AED FIM¶
To configure AED FIM, please follow the process below:
Step 1) Log into te AED Web Console
Step 2) Click on the ‘AED’ tab
Step 3) Scroll down to ‘File Integrity’ and click on that option
At this point, the file integrity manager is opened.
Step 4) Click on the ‘Options’ tab
The following options are available:
- If you are using the AED kernel, file integrity checks happen in real time and you do not need to configure this. If a file changes, and you have not put a limit on the number of emails AED is allowed to send per hour, AED will immediately alert you via email and the web console if a watched file or directory changes.
If you are not using the AED kernel, and your kernel does not support inotify, you will need to set the scan timing frequency for when AED will checks your files for changes.
Frequency: This setting tells AED, when the AED kernel is not being used, how often to check for file changes. If you are using the AED kernel checks happen in real time you do not need to set this.
- This setting is in hours : minute : seconds
Scan Day: You can also set a specific day for the scans to run, if you only wish to run them periodically. Again, if you are using the AED kernel checks happen in real time you do not need to set this.
Scan Time (Optional): You can also set the specific time to run the checks. Again, if you are using the AED kernel checks happen in real time you do not need to set this.
Auto-ignore frequently modified?
- AED can also learn if a file changes regularly to ignore previous notifications of changes to this file.
Alert on new file creation?
- AED can alert on new files that are created in watched directories.
Scan on startup?
- This tells AED to build its list of files to watch on startup. We do not recommend you disable this, as AED will not be able to notify of any changes to your files until its down its initial scan.
If AED does not show any file integrity changes:
- This means that any changes to the file system, such as inodes changing for a file, are benign and AED has determined these were authorized and non-malicious changes to the system.
Types of Events¶
- Real Time - This tells the file integrity management system to alert you if a file changes, in real time. As opposed to occassionally scanning the system to see if the file changes. We recommend you always use Real Time.
- All - Alert if any of the types of changes below occur.
- Sum - Alert if the Sum hash changes, which will occur if the file changes. This is a low security, low effort check.
- SHA 1 - Generate an SHA1 hash for the file, and alert if it changes. This is a high security, medium effort check.
- MD5 - Generate an MD5 hash for the file, and alert if the file changes. This is a low security, medium effort check.
- Size - Generate an alert if the size of the file changes. This is a low security, nearly zero effort check.
- Owner - Generate an alert if the owner of file or directory changes. This is a medium security, nearly zero effort check.
- Group - Generate an alert if the group ownership of the file or directory changes. This is a medium security, nearly zero effort check.
- Perms - Generate an alert if the permissions of the file or directory changes. This is a medium security, nearly zero effort check.
Report - For Watch rules, if a file changes AED will report what changed in the file if the file is text based, for example configuration files, web application files and other files that are text based. If the file is not text based, AED will record the change and will store either a diff of the file (just the changes), or a copy of the original and new file for examination
This can use up a lot of drive space if directories are being watched that include lots of changes, or large file changes.
- Restrict - This allows you to define a regular expression to limit the scope of the path.
This window lists the directories, and optionally the files, that AED has been configured to monitor.
Adding a New Rule
- This tells AED to watch a directory or file, and to report the specific changes that have occurred to this file or directory. AED will report the previous portion of the file, and the changed portion so you can compare them. AED will maintain copies of all changes to the files it is told to watch, and you can you this information to roll back changes and to do deep inspection of changes as opposed to trying to determine what specifically happened to the file.
AED will also report this informtion, if selected:
This tells AED to notify you if a directory or file has changed. This will not report the specific changes that have occurred to this file or directory, except for, if selected:
- This tells AED to ignore a specific file or directory. This is useful if you want to ignore a file or files in a directory you otherwise want to monitor or notify.