Atomic Protector File Integrity Manager (FIM) Configuration

Introduction

Atomic Protector has an advanced file integrity manager built in that will alert you if file changes have occurred on your system.

Accessing

To access the AP File Integrity Manager, follow this process:

Step 1) Log into the AP Web Console

Step 2) Click on the ‘Atomic Protector’ tab

Step 3) Scroll down to ‘File Integrity’ and click that option

At this point the file integrity manager will be opened.

If any files have changed that the system is configured to monitor, it will display them in this window under the ‘Files’ tab.

Configuring Atomic Protector FIM

To configure AP FIM, please follow the process below:

Step 1) Log into te AP Web Console

Step 2) Click on the ‘AP’ tab

Step 3) Scroll down to ‘File Integrity’ and click on that option

At this point, the file integrity manager is opened.

Step 4) Click on the ‘Options’ tab

The following options are available:

Global Options:

Scan Timing

  • If you are using the AP kernel, file integrity checks happen in real time and you do not need to configure this. If a file changes, and you have not put a limit on the number of emails AED is allowed to send per hour, AED will immediately alert you via email and the web console if a watched file or directory changes.

  • If you are not using the AP kernel, and your kernel does not support inotify, you will need to set the scan timing frequency for when AP will checks your files for changes.

Frequency: This setting tells AP, when the AP kernel is not being used, how often to check for file changes. If you are using the AP kernel checks happen in real time you do not need to set this.

  • This setting is in hours : minute : seconds

Scan Day: You can also set a specific day for the scans to run, if you only wish to run them periodically. Again, if you are using the AP kernel checks happen in real time you do not need to set this.

Scan Time (Optional): You can also set the specific time to run the checks. Again, if you are using the AP kernel checks happen in real time you do not need to set this.

Scan Options

Auto-ignore frequently modified?

  • AP can also learn if a file changes regularly to ignore previous notifications of changes to this file.

Alert on new file creation?

  • AP can alert on new files that are created in watched directories.

Scan on startup?

  • This tells AP to build its list of files to watch on startup. We do not recommend you disable this, as AP will not be able to notify of any changes to your files until its down its initial scan.

Usage

If AP does not show any file integrity changes:

  • This means that any changes to the file system, such as inodes changing for a file, are benign and AP has determined these were authorized and non-malicious changes to the system.

Types of Events

  • Real Time - This tells the file integrity management system to alert you if a file changes, in real time. As opposed to occassionally scanning the system to see if the file changes. We recommend you always use Real Time.

  • All - Alert if any of the types of changes below occur.

  • Sum - Alert if the Sum hash changes, which will occur if the file changes. This is a low security, low effort check.

  • SHA 1 - Generate an SHA1 hash for the file, and alert if it changes. This is a high security, medium effort check.

  • MD5 - Generate an MD5 hash for the file, and alert if the file changes. This is a low security, medium effort check.

  • Size - Generate an alert if the size of the file changes. This is a low security, nearly zero effort check.

  • Owner - Generate an alert if the owner of file or directory changes. This is a medium security, nearly zero effort check.

  • Group - Generate an alert if the group ownership of the file or directory changes. This is a medium security, nearly zero effort check.

  • Perms - Generate an alert if the permissions of the file or directory changes. This is a medium security, nearly zero effort check.

  • Report - For Watch rules, if a file changes AED will report what changed in the file if the file is text based, for example configuration files, web application files and other files that are text based. If the file is not text based, AED will record the change and will store either a diff of the file (just the changes), or a copy of the original and new file for examination

    Note

    This can use up a lot of drive space if directories are being watched that include lots of changes, or large file changes.

  • Restrict - This allows you to define a regular expression to limit the scope of the path.

Directories

This window lists the directories, and optionally the files, that AP has been configured to monitor.

Adding a New Rule

watch:

  • This tells AP to watch a directory or file, and to report the specific changes that have occurred to this file or directory. AP will report the previous portion of the file, and the changed portion so you can compare them. AP will maintain copies of all changes to the files it is told to watch, and you can you this information to roll back changes and to do deep inspection of changes as opposed to trying to determine what specifically happened to the file.

  • AP will also report this informtion, if selected:

    • Sum

    • SHA1

    • MD5

    • Size

    • Owner

    • Group

    • Permissions

notify:

  • This tells AP to notify you if a directory or file has changed. This will not report the specific changes that have occurred to this file or directory, except for, if selected:

    • Sum

    • SHA1

    • MD5

    • Size

    • Owner

    • Group

    • Permissions

ingnore:

  • This tells AP to ignore a specific file or directory. This is useful if you want to ignore a file or files in a directory you otherwise want to monitor or notify.