Topics Discussed
...
The File Integrity Monitoring (FIM) service provides collection, analysis, and notification of changes to critical operating system files, as defined by Armor's FIM policy. Armor utilizes an enterprise-class FIM application and deploys the application agent with the Armor Agent. Armor is responsible for the configuration of the FIM services via remote agent. Configuration includes the application and maintenance of the policies associated with the service. Configuration specific to the local Host or network/environment to enable the service is a Customer responsibility. Armor is responsible for the administration of the FIM service through the Armor Agent. For the purposes of this section, "administration" is defined as the management of licenses and the application used to provide the service and the administration of the underlying FIM platform.
...
...
When traditional firewalls or intrusion detection systems (IDS) fail to prevent or detect a threat, monitoring operating system (OS) and application changes at the host level provides an additional layer of detection for indicators of compromise (IOC) or a breach of your environment. Security teams are largely in the dark to an attacker's presence, activities, and movements without monitoring processes and applications at the host level. Armor FIM watches your hosts 24/7/365 for anomalous and unauthorized activities to detect potential threats. It monitors critical system file locations on your hosts as well as critical OS files for changes that may allow threat actors to control your environment.
...
| Info |
|---|
You can also manage the Trend sub-agent in the Armor Toolbox. |
Recommendation Scans
...
One of the features available in Agent 3.0 is Recommendation scans. Recommendation scans provide a good starting point for establishing a list of rules that you should implement. During a recommendation scan, the Armor Agent scans the operating system for installed applications, the Windows registry, open ports, and more. To take advantage of Recommendation scans, turn on Ongoing Recommendation scans in the Toolbox.
| Info |
|---|
Recommendation Scans work in tandem with the Auto-Apply configuration for FIM. The results of the Recommendation Scan can only be applied when Auto-Apply for the FIM service is turned on. |
The commands below can be scheduled as tasks within the Armor Toolbox.
Install Trend Sub-Agent:
...
Use the following commands to manage the File Integrity Monitoring service. These commands can be scheduled as tasks within the Armor Toolbox.
Turn On File Integrity Monitoring:
...
Column | Description |
|---|---|
Name | For Armor 's private cloudEnterprise Cloud, the name of the virtual machine you created in AMP. For Armor Anywhere, the name of the instance that contains the installed Anywhere agent, which includes the FIM sub-agent. |
Provider | For Armor 's private cloudEnterprise Cloud, the entry will display Armor. For Armor Anywhere, the name of the public cloud provider for the instance. |
Status | The health status of the sub-agent, which is based on how long the FIM sub-agent has been offline. There are three status types:
|
Connectivity | The connection status of the sub-agent. There are three connection types:
|
Timestamp | The date and time that the FIM sub-agent last communicated with Armor. |
| Info |
|---|
To learn how the overall FIM status is determined, see Understand FIM data. |
Understand FIM Data
...
In the File Integrity Monitoring screen, the dashboard displays the various FIM statuses of your virtual machines (or hosts):
...
In the Armor Management Portal (AMP), in the left-side navigation, click Security.
Click File Integrity Monitoring.
(Optional) Use the filter function to customize the data displayed.
Below the table, click CSV. You have the option to export all the data (All) or only the data that appears on the current screen (Current Set).
FUNCTION | DATA DISPLAYED | NOTES |
|---|---|---|
CSV | VM Name, VM Provider, IP Address, OS, FIM Agent Status Fixed, FIM Agent Version, FIM Last Communication Date | A blank entry indicates that the action has never taken place. |
| Info |
|---|
Troubleshooting Armor troubleshoots servers that contain File Integrity Monitoring sub-components in a Warning or Critical status. To troubleshoot with Armor, you must submit a support ticket.
|
...