Project 7

File Integrity Monitoring

Implement File Integrity Monitoring (FIM) to detect unauthorized file changes.

Integrity MonitoringHost SecurityChange Detection

Project objective

Stand up file integrity monitoring on a lab host using Wazuh's syscheck module, watch a set of security-relevant paths for unauthorized change, and prove the pipeline works by making a controlled modification and tracing it through to a generated alert.

Core work

Monitoring was scoped to the paths that matter most for detecting tampering — system config, binaries, and a web root — rather than the whole filesystem, to keep the alert volume usable.

# Configure syscheck on the Wazuh agent (ossec.conf)
sudo nano /var/ossec/etc/ossec.conf
  <syscheck>
    <directories check_all="yes" realtime="yes">/etc,/bin,/sbin</directories>
    <directories check_all="yes" realtime="yes">/var/www/html</directories>
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <frequency>43200</frequency>
  </syscheck>

sudo systemctl restart wazuh-agent

# Controlled test change #1: modify a monitored config file
echo "# fim test entry" | sudo tee -a /etc/hosts

# Controlled test change #2: drop a new file into the monitored web root
echo "<?php echo 'fim test'; ?>" | sudo tee /var/www/html/fim-test.php

# Confirm both changes generated syscheck events
sudo tail -f /var/ossec/logs/alerts/alerts.json | jq 'select(.rule.groups[]=="syscheck")'

# Standalone alternative on a host without Wazuh: AIDE
sudo aideinit
sudo aide --check

Both test changes appeared in the alert stream within the configured real-time detection window, each showing the old and new SHA-256 checksum, the exact byte-level diff for the text file, and the responsible UID — enough to immediately tell a legitimate config-management change from an unexpected one.

Added

Modified

Deleted

Permission

FIM events by change type during the test window — "Modified" dominates because routine package updates touch existing files under /etc and /bin.

What to document

The write-up lists every monitored path and why it was chosen, the exact test commands used to generate a change, the resulting syscheck event (with checksum diff), and a short note on distinguishing legitimate changes (package manager updates, admin edits) from unexpected ones (unfamiliar UID, off-hours timestamp, a path that should never change).