File Integrity Monitoring (FIM) - Learn about File Integrity Monitoring (FIM) capabilities in Cortex XDR. - Administrator Guide - Cortex XDR - Cortex - Security Operations

In Endpoints → File Integrity Monitoring → Rule groups, select +New Group.

Fill in the General Settings.

Select the Platform.

For each rule add an optional description and the required path. Pay attention to the path restrictions and wildcard use shown below, File and Folder path configuration.

Specify the events to monitor.

In Inventory → Endpoints → Policy management → Extensions → Profiles, select +Add Profile and then select either Create New or Import from File.

Select a Platform and click File Integrity Monitoring → Next.

Fill in the General Information.

Assign the profile Name and add an optional Description.

Select the Platform. For Linux, define the monitoring mode, Host or Containers

In FIM Rule Group Select +Manage Group.

Select the required FIM Rule Groups.

To save the FIM rule group definitions, click Create.

It is allowed to add up to ten rule groups to a profile.

In Inventory → Endpoints → Policy management → Extensions → Policy Rules, select + New Policy or Import from File.

Configure settings for the File Integrity Monitoring policy.

1. Assign a policy name and select the platform. You can add a description.

2. Assign the File Integrity Monitoring profile you want to use in this rule.

3. Click Next.

4. Select the target endpoints on which to enforce the policy.

   Use filters or manual endpoint selection to define the exact target endpoints of the policy rules. If exists, the Group Name is filtered according to the groups within your defined user scope.

5. Click Done.

Configure policy hierarchy.

Drag the policies in the desired order of execution. The default policy that enables all devices on all endpoints is always the last one on the page and is applied to endpoints that don’t match the criteria in the other policies.

Save the policy hierarchy.

After the policy is saved and applied to the agents, Cortex XDR enforces the File Integrity Monitoring policies on your environment.

(Optional) Manage your policy rules.

In the Prevention Policy Rules table, you can view and edit the policy you created and the policy hierarchy.

1. View your policy hierarchy.

2. Right-click to View Policy Details, Edit, Save as New, Disable, and Delete.

3. Select one or more policies, right-click and select Export Policies. You can choose to include the associated Policy Targets, Global Exceptions, and endpoint groups.