What is file integrity monitoring?
File integrity monitoring (FIM) detects changes to files and settings that should rarely change: operating system binaries, configuration files, web content, registry keys and permissions. It protects the integrity leg of the CIA triad by noticing when something has been altered, added or deleted. FIM is usually a feature of a host-based intrusion detection system (HIDS) or an endpoint agent. Well-known tools include Tripwire, OSSEC and its fork Wazuh, and AIDE on Linux.
How file integrity monitoring works
- Baseline: the tool records a cryptographic hash, usually SHA-256, of every monitored file, along with attributes such as size, owner, permissions and modification time.
- Protect the baseline: the database is stored read-only or off the host, so an intruder cannot simply update it to match their changes.
- Compare: on a schedule, or in real time through operating system change notifications, the tool rehashes files and compares them with the baseline.
- Alert: a mismatch produces an alert with the path, the old and new hashes and, when tied into operating system auditing, the user and process that made the change. Changes to text configuration files can be reported as a diff.
Alerts usually go to the SIEM, where they can be correlated with logons and change tickets.
What to monitor
- System binaries and libraries, such as
/usr/bin,/usr/sbinandC:\Windows\System32 - Account and authentication files:
/etc/passwd,/etc/shadow,/etc/sudoersand SSHauthorized_keysfiles - Service configuration, such as
sshd_configand web server configuration files - Web document roots, where a new or changed file can mean defacement or a web shell
- Persistence locations: cron jobs, scheduled tasks, services and registry Run keys
- Audit logs, which should only ever grow; PCI DSS requires change detection on them so existing entries cannot be altered without an alert
Leave out files that change constantly, such as caches and temporary folders, or their alerts will drown out everything else.
Example: a web shell caught by FIM
2026-10-22 03:14:09 fim host=web02 event=added path=/var/www/html/uploads/thumb.php sha256=4be1...9c07 user=www-data process=php-fpm
The uploads folder is meant to hold images. A new PHP file there, written by the web server's own account at 3 a.m. with no deployment scheduled, strongly suggests that an attacker abused the upload feature and planted a web shell. The analyst isolates the server, preserves the file and the logs, and checks the web access log for requests to that path.
Handling noise with change management
Patches and deployments legitimately change hundreds of files, so FIM is useful only when it is tied to change management. Correlate alerts with approved change tickets and maintenance windows, update the baseline after each approved change, and treat any change outside a window as a potential incident. Protect the monitor too: alert when the agent stops reporting, because an attacker with administrator rights may try to disable it.
FIM vs. antivirus, DLP and configuration scans
Antivirus looks for known-bad content; FIM flags any change, so it catches new rootkits and web shells that have no signature, along with benign changes that need context. DLP watches sensitive data leaving, not files changing. A compliance scan checks at scan time whether settings match a benchmark, while FIM reports the moment a monitored file changes. A HIPS can block changes to protected files; FIM in a HIDS only detects and alerts.
File integrity monitoring on the CompTIA Security+ exam
SY0-801 no longer names file integrity monitoring as a separate item, but it is taught with monitoring systems and raising alerts under objective 4.4 and as a host-based intrusion detection feature among the endpoint controls under objective 4.1. PCI DSS v4.0.1 requires a change-detection mechanism such as FIM to alert on unauthorized changes to critical files, with comparisons at least weekly. Wording such as know when anyone modifies operating system binaries, a defaced home page or notify the SOC of configuration file changes but never block points to FIM. Distractors include DLP, NetFlow, antivirus and a HIPS, which blocks rather than only alerting.