Skip to content
MoftgateMoftgate Docs
Product guide

File Integrity Monitoring

Watch the files and directories that should not change, and learn when they do.

What FIM Is#

File Integrity Monitoring watches a defined set of files and directories and reports when they change. It is a detection capability: it does not decide whether a change is malicious, it tells you that a change happened where none was expected.

This is what makes FIM valuable against threats that antivirus signatures miss: a modified configuration file, a replaced binary, or a new account file leaves a trace even when the content itself is not recognisable as malware.

FIM dashboard with event volume timeline and operation breakdown.
File Integrity Monitoring dashboard
Close image

Configuring Monitoring#

  1. 1
    Choose the paths to watch

    Start with the locations where an unexpected change matters: system directories, application configuration, and credential stores.

  2. 2
    Exclude noisy paths

    Exclude log directories, caches, and temporary folders. Watching them produces change volume without security value.

  3. 3
    Capture a baseline

    Record the current state of the watched paths. The baseline is what every later change is compared against.

  4. 4
    Set the alert level

    Decide which change types raise an alert. Creation and deletion in a system directory usually deserve more attention than a metadata change.

  5. 5
    Review the first week

    Read the changes produced by legitimate software updates so you can distinguish them from real anomalies.

Baseline#

A change is only meaningful relative to a known state. The baseline is that state. Without one, FIM reports the existence of files rather than changes to them.

  • Capture a baseline when the endpoint is in a known-good state, ideally right after provisioning.
  • Refresh the baseline after every planned change, such as an operating system update or a deployment.
  • Record why the baseline was refreshed, so the next reviewer understands the gap in coverage.
  • Never refresh a baseline to silence an alert you have not investigated.

Alerts and Response#

FIM reports five change types:

Change typeWhat happened
CreatedA new file appeared in a watched location.
ModifiedThe content or metadata of a watched file changed.
DeletedA watched file disappeared.
Permission changedAccess rights on a watched file or directory changed.
Owner changedThe owning account of a watched file changed.
Investigate before you refresh
The most common mistake with FIM is refreshing the baseline to clear an alert. That removes the evidence and leaves the change unexplained.

Frequently Asked Questions#

Does FIM scan the whole disk?
No. FIM watches the paths you select. Watching everything produces a change stream that nobody can review and that consumes endpoint resources.
How is FIM different from antivirus?
Antivirus looks for known malicious content. FIM detects that a file changed when it should not have, regardless of whether the change is known to be malicious.
What causes most false positives?
Software updates and configuration management tools writing to watched paths. Capture a baseline after each planned change, and exclude paths that only contain generated files.
Where do FIM alerts appear?
FIM changes appear in the endpoint activity and can be routed into the threat investigation queue through monitoring policies.