FIM (File Integrity Monitoring)?

Comments...SolarWinds...somebody...anybody? 

We don't currently have a true FIM solution (basically, people are using windows file auditing with LEM to get by), but we're looking into it. Nothing inevitable, and no timelines (as usual ).

Would you be using it in the same space as LEM - that is, if it were a part of the LEM agent (like USB-Defender), would that suffice? Or do you need/prefer something standalone to integrate in other ways?

I would prefer it be part of LEM.  SIEM & FIM are joined at the hip as far as I am concerned and only having to deal with one agent for both would be preferable.  To me they belong in the same space.

Our company is in the process of selecting a FIM to pair with a SIEM to create a complete solution for compliant cloud environments.

We would also be intrested in this.  As a company we are continually trying to reduce the number of tools needed to perform our jobs, so having something like this integrated in LEM would be a big plus.

, you suggest using Windows File Auditing, does LEM not have something similar for Linux?  Is this a specific connector or just a set of rules used to watch for specific events... or a combination of the two.  Basically I am interested in how I would configure this so I can test it out.

Thanks in advance for helping out with this.

With Linux, you can try using the linux audit framework to audit access/changes to files. It's a little different than Windows auditing (I don't think it's as granular with regard to what types of access to audit - read/write/list/etc), but should accomplish a similar goal. Neither of them are really File Integrity Monitoring in the true sense, but if what you're interested in is "oh crap, a file changed, and it wasn't by root/administrator" they should help.

A link from SuSE about audit: Chapter�30.�Understanding Linux Audit

Another link: Linux audit files to see who made changes to a file

Once you set that up, you should be able to use similar rules to Windows - we don't have any specific to Linux. The file/object audit events will be triggered almost identically, but the information will differ slightly based on what's available.

familyofcrowes and byrona, as folks who have expressed interest in FIM, if you have time next week we're doing a little more digging into this. I posted a new thread - Interested in File Integrity Monitoring with LEM? Seeking volunteers...

I should be available next week to discuss.  Let me know if you had some dates/times in mind, thanks!