> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/wazuh/wazuh-dashboard-plugins/llms.txt
> Use this file to discover all available pages before exploring further.

# File Integrity Monitoring

> Monitor file changes including permissions, content, ownership, and attributes to detect unauthorized modifications

## Overview

File Integrity Monitoring (FIM) is a critical security capability that tracks changes to files and directories across your infrastructure. The module generates alerts related to file modifications, including changes to permissions, content, ownership, and attributes, helping you detect unauthorized access and maintain system integrity.

## Key Features

### Comprehensive File Change Detection

FIM monitors multiple aspects of file changes:

* **Content Modifications**: Detect when file contents are modified
* **Permission Changes**: Track changes to file permissions and access controls
* **Ownership Changes**: Monitor modifications to file ownership
* **Attribute Changes**: Detect changes to file attributes and metadata
* **File Creation/Deletion**: Track when files are created or deleted

### Real-time Monitoring

* **Immediate Alerts**: Receive alerts as file changes occur
* **Who-Data**: Capture information about who made the changes (user, process)
* **Change Correlation**: Correlate file changes across your infrastructure

### Interactive Dashboards

FIM provides dedicated dashboards for file integrity analysis:

* **Overview Dashboard**: System-wide view of file changes (Dashboard ID: `fim-overview-dashboard`)
* **Agent Dashboard**: File changes for specific agents (Dashboard ID: `fim-pinned-agent-dashboard`)
* **Visual Analytics**: Charts and graphs showing file change trends

## Event Data Structure

FIM events include the following key fields:

| Field | Description |
| - | - |
| `timestamp` | When the file change occurred |
| `wazuh.agent.id` | ID of the agent that detected the change |
| `wazuh.agent.name` | Name of the monitoring agent |
| `file.path` | Full path to the modified file |
| `event.type` | Type of event (creation, modification, deletion) |
| `event.action` | Specific action performed |
| `file.inode` | File system inode number |

## Data Sources

FIM utilizes multiple index patterns for comprehensive file monitoring:

### Events Data

* **Pattern**: `wazuh-events*`
* **Type**: Real-time file change events

### States Data

* **Files Pattern**: `wazuh-states-fim-files*`
* **Registry Keys Pattern**: `wazuh-states-fim-registry-keys*` (Windows)
* **Registry Values Pattern**: `wazuh-states-fim-registry-values*` (Windows)

## Inventory View

The FIM inventory provides a comprehensive view of monitored files:

### File Inventory

Access detailed information about all monitored files:

* Current state of monitored files
* File checksums (MD5, SHA1, SHA256)
* Permission details
* Ownership information
* Last modification time

**Component**: `InventoryFIMFiles`\
**Location**: `/plugins/main/public/components/overview/fim/inventory/`

### Windows Registry Monitoring

For Windows systems, FIM also monitors registry changes:

* Registry key creation/deletion
* Registry value modifications
* Permission changes on registry keys

## Configuration

### Monitored Directories

Configure which directories and files to monitor:

```xml theme={null}
<syscheck>
  <directories>/etc,/usr/bin,/usr/sbin</directories>
  <directories>/home</directories>
</syscheck>
```

### Monitoring Options

Customize monitoring behavior:

* **Real-time Monitoring**: Enable immediate detection of changes
* **Who-data**: Capture process and user information
* **Recursion Limits**: Control directory depth for monitoring
* **File Ignore Rules**: Exclude specific files or patterns

## Use Cases

### Security Incident Detection

Detect unauthorized file modifications:

1. Monitor critical system files and directories
2. Set up alerts for changes to configuration files
3. Investigate suspicious file modifications
4. Correlate file changes with other security events

### Compliance Requirements

Meet regulatory compliance standards:

* **PCI DSS 11.5**: Monitor critical files for unauthorized changes
* **HIPAA**: Track access to files containing sensitive health information
* **SOX**: Monitor changes to financial system files
* **GDPR**: Track access to files containing personal data

### Change Management

Support IT change management processes:

* Verify authorized changes were made correctly
* Detect unauthorized or undocumented changes
* Audit system configuration changes
* Track application deployment changes

### Malware Detection

Identify malware through file system changes:

* Detect creation of malicious files
* Monitor modifications to system binaries
* Identify ransomware encryption activities
* Track suspicious file permission changes

## Integration with Other Modules

FIM integrates with several other security modules:

* **Threat Hunting**: Correlate file changes with security alerts
* **Malware Detection**: Identify malware-related file modifications
* **Configuration Assessment**: Verify file configurations against baselines
* **System Auditing**: Link file changes to user actions

## Best Practices

1. **Monitor Critical Paths**: Focus on system directories, configuration files, and application binaries
2. **Enable Who-data**: Capture user and process information for better forensics
3. **Use Exclusions Wisely**: Exclude high-churn directories to reduce noise
4. **Regular Baseline Updates**: Update file baselines after authorized changes
5. **Set Appropriate Alert Thresholds**: Balance between detection and alert fatigue
6. **Integrate with SIEM**: Forward FIM events to your SIEM for correlation
7. **Test Monitoring**: Regularly verify FIM is detecting changes as expected

## Performance Considerations

* **Scan Scheduling**: Configure periodic scans during off-peak hours
* **Real-time vs Scheduled**: Balance between immediate detection and system impact
* **Database Optimization**: Regularly maintain the FIM database
* **Filter Noise**: Exclude temporary files and frequently changing logs

## Component Architecture

The FIM module is built using the following components:

```typescript theme={null}
// Dashboard component
DashboardFIM
  DataSource: FIMDataSource
  Repository: EventsDataSourceRepository
  Dashboard ID: fim-overview-dashboard
  Agent Dashboard ID: fim-pinned-agent-dashboard

// Inventory component
InventoryFIMFiles
  DataSource: FIMFilesStatesDataSource
  Repository: FIMFilesStatesDataSourceRepository
  Inventory ID: fim-files-inventory
```

Location in codebase: `/plugins/main/public/components/overview/fim/`

## Sample Data

The module supports sample data for testing and demonstration:

* **Category**: File Integrity Monitoring
* **Sample Pattern**: `wazuh-states-fim*`

## Related Resources

* [Configuration Assessment](/modules/configuration-assessment)
* [System Auditing](/modules/system-auditing)
* [Malware Detection](/modules/malware-detection)
* \[Agent Configuration(/agents/configuration)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.