Fim

File & Registry Integrity Monitoring (FIM)

The Integrity extension (ext-integrity) automates integrity checks of file systems and registry values through pattern-based rules. When a monitored file or registry key is modified, a FIM_HIT event appears in the sensor timeline.

Core Concepts

• FIM is consolidated with EDR — no separate agent needed
• Real-time alerts for modifications
• One year of historical FIM data via Insight
• Rules are scoped by platform and sensor tags

Enabling

limacharlie extension subscribe --name ext-integrity --oid <oid>

Managing Rules

# List rules
limacharlie extension request --name ext-integrity --action list_rules --oid <oid> --output yaml

# Add rule
limacharlie extension request --name ext-integrity --action add_rule --data '{"name":"linux-ssh-configs","patterns":["/root/.ssh/*","/home/*/.ssh/*"],"tags":["server"],"platforms":["linux"]}' --oid <oid> --output yaml

# Remove rule
limacharlie extension request --name ext-integrity --action remove_rule --data '{"name":"linux-ssh-configs"}' --oid <oid> --output yaml

Rule Patterns

Patterns support wildcards: * (any characters), ? (single character), + (one or more characters).

Windows File Patterns

Gotcha: Windows directory separators (backslash) MUST be escaped with double-backslash \\ in patterns.

Windows Registry Patterns

All registry monitoring patterns MUST begin with \REGISTRY, followed by the hive and then the path.

Gotcha: the prefix is \REGISTRY, NOT HKLM or HKEY_LOCAL_MACHINE. This is a common mistake.

Linux Patterns

macOS Patterns

Linux Support Differences

Linux with eBPF Support

On eBPF-capable systems, FIM capabilities are on par with Windows and macOS — full file notification with efficient kernel-level monitoring.

Legacy Support (inotify)

On systems without eBPF, FIM uses inotify (active monitoring, not passive):

• Paths with wildcards are less efficient and only support monitoring up to 20 sub-directories covered by the wildcard
• Final wildcard * required for directory monitoring: omitting the final * results in only the top-level directory being monitored, not its contents
• Example: /home/*/.ssh/* works, but /home/*/.ssh only monitors the .ssh directory entry itself

FIM_HIT Event Structure

When a monitored path is modified, a FIM_HIT event is generated containing:

• The file or registry path that was modified
• Process information (which process made the change)
• Timestamp of the modification

Use FIM_HIT events in D&R rules for automated response:

# Example: detect FIM hits on critical Windows persistence locations
event: FIM_HIT
op: starts with
path: event/FILE_PATH
value: \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

IaC Format

extension_config:
  ext-integrity:
    data:
      rules:
        - name: windows-persistence
          patterns:
            - '?\Windows\System32\drivers'
            - '\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run*'
          tags: [windows-server]
          platforms: [windows]
        - name: linux-ssh
          patterns:
            - '/root/.ssh/*'
            - '/home/*/.ssh/*'
          tags: [linux-server]
          platforms: [linux]
    usr_mtd:
      enabled: true
      expiry: 0

Gotchas Summary