File and Registry Integrity Monitoring

This page contains details for events generated by File and Registry Integirty Monitoring, or "FIM", Sensor commands.

FIM_ADD

Response event for the fim_add sensor command. An ERROR: 0 implies the path was successfully added.

Platforms:

Output:

"event": {
  "ERROR":0
}

FIM_DEL

Response event for the fim_del sensor command. An ERROR: 0 implies the path was successfully removed.

An ERROR: 3 response implies the provided path was not found in the list of FIM patterns.

Platforms:

Output:

"event": {
  "ERROR":0
}

FIM_LIST_REP

Response event for the fim_get sensor command. The response will be a JSON list of FIM patterns.

Platforms:

Output:

{
  "PATTERNS": [
    0: "/home/*",
    1: "/home/*/.ssh/*",
    2: "/root/.ssh/authorized_keys"
  ]
}