File integrity monitoring, or FIM, helps protect your system and application
files by monitoring for unauthorized changes and providing you with real-time
alerts of any suspicious activity on Windows servers and workstations.
This video shows you how to configure file integrity monitoring with SolarWinds Security Event Manager.
To begin, navigate to the Nodes console.
Under Type, check "Agent" to only display nodes that have agents associated with them.
Select the node to enable FIM.
Select "Manage Node Connectors."
To monitor this node for file and directory changes, choose "FIM File and Directory" from the available connectors.
Check the box next to the connector and select "Create Configuration."
In most organizations, file changes occur naturally and frequently.
You don't want to waste time investigating a bunch of alerts that are associated with normal business operations.
By using SEM, you can reduce the amount of noise by filtering to include or exclude specific file types or directories.
Click on "Create inclusions."
Enter the directory path in the text box below "Directories to watch," and click "Browse."
Select the directories you wish to monitor.
Next, establish the conditions that you want to monitor by selecting "Depth" and
"Mask" values under the "Condition to watch for" section.
Select a cursive or non-recursive depth value and enlist the wildcard file types
that the depth value should be applied to.
Once the conditions are established, determine which actions you want to receive alerts for.
For directories, you can choose to be alerted if a new folder is created, or an existing one is deleted.
For files, you can monitor for a file that is accessed, edited, created, or deleted.
And you can monitor existing permissions to see if they have been accessed or edited.
For this example, we want to monitor directories for both folder creation and deletion,
files for addition, creation, and deletion, and permissions for editing.
Once you've selected the actions, click "Create." The System32 config directory is now
configured for monitoring and should appear in the main window.
You can configure as many directories to monitor as needed.
Configuring exclusions is a little easier.
SEM monitors all locally connected discs and directories by default.
Simply establish which file types to exclude from the monitoring process and click "Create."
You can also import existing file integrity monitoring settings by choosing "Import from template."
Selecting a template from the drop-down menu and clicking "Import."
All of the FIM rules associated with the imported template will be displayed in the main window.
If you create a new FIM rule that can be used on other nodes as well,
you can export your rule to a template that can easily be imported onto additional nodes.
To do this, select "More," and then "Export to template."
Name the template and click "Export all."
You can now import this rule to additional nodes.
Once you have created all your inclusions and exclusions, click "Next."
You can change or edit the name of the FIM connector to make it more identifiable, then click "Create."
The events console will now display all the changes taking place in real time, as well as the historical changes.
Correlation rules can also be enabled to alert and respond to any unusual file activity.
For more information on file integrity monitoring and Security Event Manager, visit support.solarwinds.com.