File Integrity Monitoring Tool

A File Integrity Monitoring Tool continuously monitors critical system files and directories to detect unauthorized changes, additions, or deletions that could indicate malicious activity. It logs all modifications, generates alerts for suspicious changes, and helps maintain compliance with security policies. By providing real-time monitoring and tamper-evident audit trails, it allows organizations to quickly identify potential breaches and respond before significant damage occurs.

import os, hashlib, time

watched_dir = '/path/to/monitor'

def hash_file(filepath):
    h = hashlib.sha256()
    with open(filepath, 'rb') as f:
        h.update(f.read())
    return h.hexdigest()

# Initialize file hashes
file_hashes = {f: hash_file(os.path.join(watched_dir, f)) for f in os.listdir(watched_dir)}

while True:
    for f in os.listdir(watched_dir):
        path = os.path.join(watched_dir, f)
        if os.path.isfile(path):
            current_hash = hash_file(path)
            if f not in file_hashes:
                print(f"New file detected: {f}")
            elif file_hashes[f] != current_hash:
                print(f"File changed: {f}")
            file_hashes[f] = current_hash
    time.sleep(5)

Real-time File Change Detection

Monitor critical system and application files in real-time for any unauthorized modifications, additions, or deletions. Log every detected change with timestamp, user, and file path. Alert administrators immediately on suspicious activity. Integrate with SIEM or logging systems to maintain audit trails. Helps detect intrusions or malware at an early stage.

Baseline Hashing

Establish cryptographic hash baselines for all monitored files at a known safe state. Compare current hashes periodically or on-change to detect modifications. Store baselines securely to prevent tampering. Include versioning to allow safe rollback if needed. Ensure baseline updates are controlled and logged.

Scheduled Integrity Scans

Run periodic scans of files and directories to detect changes missed by real-time monitoring. Filter directories and file types as needed. Generate detailed reports highlighting deviations from the baseline. Automate scans via cron (Linux) or Task Scheduler (Windows). Store historical scan results for trend analysis.

Alerting and Reporting

Generate alerts through email, messaging, or dashboards whenever integrity violations occur. Include detailed info: file path, type of change, timestamp, and hash differences. Allow thresholds and severity levels to reduce alert fatigue. Provide periodic summary reports for audits and compliance. Integrate alerts with incident response workflows.

Remediation and Rollback

Enable automated or semi-automated remediation when unauthorized changes are detected. Maintain secure backup copies or snapshots for rollback to last known good state. Provide scripts or APIs to restore files safely. Log all remediation actions for audit purposes. Include role-based access to prevent unauthorized rollback.