FIM walks a set of host paths, hashes every file with SHA-256, and compares the result against a per-agent baseline.
- Tool — a Python walk +
sha256, raw output as ndjson. - First run (or any run with
params.mode="baseline") establishes the baseline and reports no findings. - Later runs report new, content-changed, removed, and attribute-changed files versus that baseline.
Default scope
REEF_FIM_DEFAULT_PATHS — /etc, /bin, /sbin, /usr/bin, /usr/sbin,
/boot.
Params
| Key | Default | Effect |
|---|---|---|
mode |
check |
baseline re-establishes the baseline and emits no findings |
paths |
REEF_FIM_DEFAULT_PATHS |
host-absolute directories to hash |
max_files |
40000 |
inventory cap; hitting it truncates the walk and warns |
Try it
- Run File Integrity once — this baselines and reports nothing.
touch(or edit) a file under/etcon the host.- Run it again — the changed file shows up as a finding.