> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/file-integrity-monitoring-fim.md). # File Integrity Monitoring (FIM) File Integrity Monitoring (FIM) serves as a security control designed to detect unauthorized or anomalous modifications to files and folders in the file system. Any change, such as, a new file being created or an existing file being modified, will trigger an event that is sent to the Cortex Platform. Cortex XDR agent integrates FIM capabilities directly into its endpoint detection and response engine, enhancing the fidelity and actionable intelligence derived from file events. This also allows seamless deployment of FIM capabilities over workstations and servers with the XDR agent installed. {% hint style="info" %} ### License File Integrity Monitoring usage requires a dedicated FIM add-on or the Cloud Runtime Security add-on, with XDR Pro capabilities enabled. {% endhint %} File Integrity Monitoring requires a Cortex XDR agent with version 8.9.0 and above. FIM capabilities can be enabled on the following platforms and environments. See [Where can I install Cortex XDR agent](/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent.md) for full platform options.
| Platform | Available Implementation | | ---------- | -------------------------- | | Windows | Servers and workstations | | Linux | User mode and Kernel mode | | Kubernetes | Containerized environments | **Configuration and implementation** FIM rules are used to define which files and folders should be monitored, and FIM rule groups are used to consolidate multiple FIM rules into a single entity. Creating, modifying and viewing FIM rule groups and rules is be done in the Rule Groups page, located at the **Inventory** → **Endpoints** → **File Integrity Monitoring** menu. First, create a new rule group by choosing **+ New Group**. See [Add a new FIM rule group](#add-a-new-fim-rule-group). After defining the general settings of the group, set up FIM rules in the Rules section by selecting **+ Add rule** with the following properties: * Description: a brief description of the rule and its purpose * Path: the path of the file or folder to be monitored. See the [**File and Folder path configuration** ](#file-and-folder-path-configuration)section for more information. * Events To Monitor: type of events that should be monitored. **Any** will capture all events on the defined file path, **Specific events** allows the selection of specific event types as Delete, Create, Modify. When choosing Any, new types of events that may be added in the future will also be monitored. Once created, a FIM rule group must be assigned to a specific File Integrity Monitoring extension profile. See [**Apply File Integrity Monitoring profiles to your endpoint policies**](#apply-file-integrity-monitoring-profiles-to-your-endpoint-policies). {% hint style="info" %} ### Note It is recommended to create a policy that targets only the necessary files and folders. {% endhint %}
Add a new FIM rule group Create a new FIM rule group, then set up FIM rules in the Rules section by selecting **+ Add rule** 1. In **Endpoints** → **File Integrity Monitoring** → **Rule groups**, select **+New Group**. 2. Fill in the **General Settings**. * Assign a profile **Name** * Add a brief **Description** to describe the rule group and its purpose. 3. Select the **Platform**. * For Linux, define the monitoring mode, **Host** or **Containers**

Note

Platform cannot be changed once a rule group has been created

4. For each rule add an optional description and the required path. Pay attention to the path restrictions and wildcard use shown below in **File and Folder path configuration**. 5. Specify the events to monitor. * **Any** will capture all events on the defined file path. New types of events that may be added in the future will also be monitored. * **Specific events** allows the selection of the event types, Delete, Create, Modify. {% hint style="info" %} ### Note A rule group can contain up to 100 rules. {% endhint %}
Add a new FIM rule group profile 1. In **Inventory** → **Endpoints** → **Policy management** → **Extensions** → **Profiles**, select **+Add Profile** and then select either **Create New** or **Import from File**. 2. Select a **Platform** and click **File Integrity Monitoring** → **Next**. 3. Fill in the **General Information**. Assign the profile **Name** and add an optional **Description**. 4. Select the **Platform**. For Linux, define the monitoring mode, **Host** or **Containers** 5. In FIM Rule Group Select **+Manage Group**. Select the required FIM Rule Groups. 6. To save the FIM rule group definitions, click **Create**. 7. It is allowed to add up to ten rule groups to a profile.
Apply File Integrity Monitoring profiles to your endpoint policies After you define the required File Integrity Monitoring profiles, configure policies with File Integrity Monitoring and enforce them on your endpoints. Cortex Cloud applies File Integrity Monitoring policies on endpoints from beginning to end, as you’ve ordered them on the page. The first policy that matches the endpoint is applied. If no policies match, the default policy that enables all devices is applied. 1. In **Inventory** → **Endpoints** → **Policy management** → **Extensions** → **Policy Rules**, select **+ New Policy** or **Import from File**.

Note

When importing a policy, select whether to enable the associated policy targets. Rules within the imported policy are managed as follows:

2. Configure settings for the File Integrity Monitoring policy. 1. Assign a policy name and select the platform. You can add a description. 2. Assign the File Integrity Monitoring profile you want to use in this rule. 3. Click **Next**. 4. Select the target endpoints on which to enforce the policy. Use filters or manual endpoint selection to define the exact target endpoints of the policy rules. If exists, the **Group Name** is filtered according to the groups within your defined user scope. 5. Click **Done**. 3. Configure policy hierarchy. Drag the policies in the desired order of execution. The default policy that enables all devices on all endpoints is always the last one on the page and is applied to endpoints that don’t match the criteria in the other policies. 4. **Save** the policy hierarchy. After the policy is saved and applied to the agents, Cortex Cloud enforces the File Integrity Monitoring policies on your environment. 5. (Optional) Manage your policy rules. In the **Prevention Policy Rules** table, you can view and edit the policy you created and the policy hierarchy. 1. View your policy hierarchy. 2. Right-click to **View Policy Details**, **Edit**, **Save as New**, **Disable**, and **Delete**. 3. Select one or more policies, right-click and select **Export Policies**. You can choose to include the associated **Policy Targets**, **Global Exceptions**, and endpoint groups.
#### **File and Folder path configuration** | Platform | Path restrictions | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Windows | | | Linux | |
View File Integrity Monitoring events After you apply File Integrity Monitoring rules in your environment, use the **Inventory** → **Endpoints** → **File Integrity Monitoring** page to monitor events. The most recent events are displayed on the page. You can sort the results and use the filters menu to narrow down the results. Use XQL to view all FIM events by querying the ‘xdr\_dataset’ with the filter ‘fim\_event = TRUE’. {% hint style="info" %} ### Note It is possible to ingest up to 15,000 events per day (24 hours) for each host/container. {% endhint %}
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/file-integrity-monitoring-fim.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.