VERISCO Alertio Investigate
File integrity
What changed, where and when, on the files and directories you choose to monitor, with the evidence to prove a change was real.
Open File Integrity in the Investigate group. Three tabs are available.
Overview#
Change volume and its distribution across the fleet, for the selected period.
Events#
The change feed.
| Control | What it does |
|---|---|
| Change type | Added, modified or deleted. |
| Filter | Matches a path or an agent. |
| Date range | Limits the period. |
| Export CSV | Downloads the filtered events. |
Select an event to compare the file before and after the change: its checksums, its permissions and its other attributes. A difference in checksum is what confirms the content itself changed, not just its metadata.
File changes take part in correlation like any other alert. A change that matches a known attack signature, such as mass modification on a monitored share, is placed on its kill-chain stage.
Policy#
The directories being monitored, and which agent group each applies to.
| Control | What it does |
|---|---|
| Add monitored path | Adds a directory, scoped to an agent group. |
| Edit and Delete | Change or remove a path. |
| Set pending and Enable | Suspend a path without deleting it, and resume it. |
| Apply policy | Pushes the policy to the agents. |
| Run scan | Requests an immediate integrity scan. |
The synchronisation panel shows which agents have received the current policy. Changing the policy requires the Administrator role; everyone can read it.
Monitor what an attacker would touch
Start with system binaries, startup locations, web roots and shares that hold business data. Monitoring everything produces noise; monitoring the right paths produces evidence.
Something missing or wrong on this page? Tell us and we will fix it.