Security operations
File integrity monitoring
Integrity monitoring answers a narrow question extremely well: did something on disk change that should not have? The skill is not reading the diff — it is knowing which paths matter and which change is expected.
Change events (24h)
1,284
On monitored critical paths
9
High or critical
6
Outside change window
4
Change events
Highest-signal changes on monitored scopes.
| Time | Host | Path | Action | Actor | Severity |
|---|---|---|---|---|---|
| 09:41:12 | SRV-DC-01 | C:\Windows\System32\GroupPolicy\Machine\Registry.pol | modified | ACME\svc-gpo | high |
| 09:38:04 | WS-FIN-014 | C:\Users\a.pratama\AppData\Roaming\upd\svchost32.exe | added | ACME\a.pratama | critical |
| 09:22:55 | SRV-WEB-01 | /etc/ssh/sshd_config | modified | root | critical |
| 09:10:31 | SRV-DB-01 | /var/lib/db/conf/pg_hba.conf | modified | postgres | high |
| 08:57:19 | SRV-FILE-02 | D:\Shares\Finance\Q3-forecast.xlsx | permissions | ACME\d.moreau | high |
| 08:44:02 | SRV-WEB-01 | /var/www/app/uploads/report.php | added | www-data | critical |
| 08:20:47 | MBP-DESIGN-02 | /Library/LaunchDaemons/com.updater.plist | added | root | medium |
| 07:58:36 | SRV-BUILD-03 | /opt/ci/pipeline/deploy.sh | modified | ci-runner | medium |
| 07:31:09 | SRV-FILE-02 | D:\Shares\Legal\archive.zip | deleted | ACME\svc-backup | low |
Change detail
SRV-DC-01
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
- sha256:8c1e…41ab
+ sha256:2f77…90cd
Policy object changed outside the change window.
Monitored scopes
What is watched, how often, and how loud it is.
Windows system directories
6 paths · 5 hosts · Realtime + hash · 12 alerts / 7d
Linux configuration (/etc)
11 paths · 4 hosts · Realtime + hash · 9 alerts / 7d
Web content roots
3 paths · 2 hosts · Realtime · 7 alerts / 7d
Finance & legal shares
4 paths · 1 hosts · Scheduled 15m · 4 alerts / 7d
Persistence locations
8 paths · 8 hosts · Realtime · 3 alerts / 7d
Choosing paths worth monitoringmethod›
- Configuration that changes security posture: authentication settings, access policy, scheduled tasks, service definitions.
- Persistence locations: startup directories, system daemons, run keys, cron paths.
- Content roots where a written script becomes executable code — the classic web-shell path.
- Sensitive data shares, mainly for permission changes rather than content edits.
- Not: temp directories, caches, log files, or anything a normal application writes continuously.
Expected change vs intrusiontriage›
Three questions settle most integrity alerts. Who made the change — a human, a service account, or a deployment tool? What process wrote it — a package manager and a script host imply very different stories. When did it happen — inside a change window with a matching ticket, or at 03:40 with nothing to reference? A change with a named owner, an expected process and a matching change record is documented maintenance. Remove any one of the three and it becomes an investigation.
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Intermediate · Guided Lab · 30 min
Process tree analysis
The phishing chain on WS-FIN-014 produced a process tree. Reconstructing parent-child relationships tells you exactly how the intrusion executed.
Foundation · Theory · 15 min
Anatomy of an alert
Alert ALT-2400 has just fired: encoded PowerShell spawned by Microsoft Word on a finance workstation. Before deciding anything, you need to read the alert properly — every field exists for a reason.
Advanced · Guided Lab · 28 min
Containment decisions under pressure
WS-FIN-014 still has an active C2 channel and the account a.pratama may be in use by the attacker. You must choose containment now, and every option costs something.