File Integrity Monitoring tells you when critical system files change. It records a fingerprint (a SHA-256 hash) of every file in the watched directories, and later scans compare the host against that baseline.
Supports: NIST 800-53 SI-7 (Software, Firmware, and Information Integrity) and CM-3 (Configuration Change Control).
How it works
- The first scan records the baseline and reports no findings.
- Later scans compare the host with the baseline and report:
| Change | Severity |
|---|---|
| File contents changed | High |
| File removed | High |
| Permissions or ownership changed | Medium |
| New file added | Low |
New files are reported once and then added to the baseline. Changed and removed files stay open until the original file is restored, at which point the finding resolves automatically, or until you re-baseline.
After an approved change, such as a patch or a planned configuration update, re-baseline the host so that only unexpected changes remain. To do this, run the scan with {"mode": "baseline"}.
Default coverage
System configuration and binaries: /etc, /bin, /sbin, /usr/bin, /usr/sbin, and /boot. To change the default for every host, set REEF_FIM_DEFAULT_PATHS (see the Configuration reference).
Options
| Key | Default | Effect |
|---|---|---|
mode |
check |
baseline records a new baseline and reports no findings. |
paths |
REEF_FIM_DEFAULT_PATHS |
List of directories to monitor. |
max_files |
40000 |
The maximum number of files to check. If the limit is reached, the scan stops early and shows a warning. |
Try it
- Run File Integrity once. This records the baseline and reports nothing.
- On the host,
touchor edit a file under/etc. - Run it again. The changed file now appears as a finding.