File Integrity Monitor (FIM) monitors a host’s local system for changes to specified files, directories, and registry settings to detect illicit modifications. FIM accomplishes its task by creating signatures of its targets during each scan and comparing them to signatures from the previous scan. Any changes are reported to a server, while the signatures for the current scan are saved in a local cache for future use. Our server analyzes the changes to identify security events which are then made available to the customer in the Self Service FIM application in the portal. The portal's Self Service FIM is broken down into three sections: Dashboard, All Events, and Email Preferences.
This module can be provided to customers using Windows or Linux operating systems.
When FIM is first installed on a host, it can take up to 24 hours for the first FIM report to appear in the portal. Once the first report has been received, FIM runs and reports nightly.
FIM in the Portal
A dashboard provides a quick look at the FIM activity of the client's agent population.
- Changes by Agent is a list of all agents running FIM that shows an event history of the past 30 days. The list can be filtered to show or hide agents that have not submitted a FIM report, and to show only critical or high severity events. Critical events are shown as red dots. Selecting an event block that contains a critical event marker will display critical and high severity events from that date in the Critical Events table.
- Event Volume is a vertical bar graph that shows a breakdown of events by type and amount over the past 30 days. Selecting an event block in the Changes by Agent calendar will display the event volume chart for the selected date.
- Critical Events lists only the most recent critical or high severity events. Selecting an event will open it in the Dashboard | Details sub-menu, which operates in the same manner as the All Events page.
All Events is an interface clients can use to search through the entire history of FIM events for all agents. Events may be sorted by severity and date. Clients may also search for specific findings or finding types. Clicking on a finding populates the event details menu at the bottom of the page, which displays the Event ID, Type, IP address, OS, Time, Priority, Source, and Description. All data can be exported as an excel sheet, PDF, CSV or HTML.
The Email tab allows users to configure their FIM email preferences. They may choose whether or not to receive emails and the frequency of receipt (daily or weekly). They may also elect to only receive email notifications about critical and high severity events. Changes to email preferences in FIM do not affect email preferences for other applications.
Configurations and Custom Profiles
FIM configurations are lists of files, directories, and registry settings that SpiderLabs has determined are vulnerable. These configurations identify and instruct FIM to scan the following items:
- Files
- Directories, recursively and not
- Files that match patterns in specified directories
- Registry keys, recursively and not
- Registry values
Occasionally a client requests that we configure FIM to monitor certain files in addition to that covered by our standard profiles. In general, we will only create a custom profile if the client can tell us the specific pathways they want to monitor. We do not help clients decide which files need to be monitored, other than those that are included in the standard FIM profiles. If a client wants our input, they will need to work with sales and develop a special work order for this service.
If you have access to SAM, you can create or apply a custom FIM profile for an individual agent. For a large population of agents who will have identical custom profiles, agent engineering can create a custom template for the client. Contact Trustwave for a copy of the Trustwave File Integrity Monitoring Template Guide for details.