Patch Management

File Integrity Monitoring

Learn how to scope a FIM configuration to specific endpoints and paths, read the events dashboard with its trend and category charts, drill into a MODIFY event's forensic detail (process, username, PID, hashes), and use the line-level diff viewer to see exactly what changed.

1 min
June 1, 2026

What You'll Learn

How to create a FIM configuration scoped to specific endpoints and paths
Read the FIM events dashboard, including trend and category breakdowns
Investigate a MODIFY event's forensic detail: process, username, PID, and hashes
Compare old and new file versions line by line with the diff viewer
Track change trends over time to catch a spike close to when it happens
Scope Include/Exclude Paths to keep the event feed signal-rich, not noisy

Frequently Asked Questions

What's the difference between a MODIFY event and a real security incident?

A MODIFY event only confirms that monitored content changed. Whether it's a security incident depends on the Process, Username, and the actual diff content behind it. Review all three before treating an event as an incident. See [how to configure and review File Integrity Monitoring](/learn/fim/how-to-configure-and-review-file-integrity-monitoring) for where each field is captured.

Do I need to open the diff viewer for every event?

Not necessarily. For high-volume, low-risk paths, the hash and process detail may be enough for routine review. Reserve the diff viewer for events from unexpected processes, unusual timing, or any path where the actual content change matters.

Can one configuration watch more than one file?

Yes, Include Paths can point to a folder rather than a single file, and Exclude Paths can carve out sub-paths that shouldn't trigger events. Start with a single file to validate the configuration before widening scope.

Why does the same file show multiple versions in the comparison view?

Each MODIFY event captures a new version snapshot. If a file changes repeatedly, each change produces its own old-version/new-version pair, so any two points in its history can be compared.

What do the MD5, SHA256, and SHA1 hashes each confirm?

All three independently confirm whether the file's content is identical to a prior state. Capturing multiple hash algorithms per event makes the record harder to dispute and easier to cross-verify against other tooling.

Does FIM stop the change from happening, or only report it?

FIM detects and records the change, it does not block the write. Use the Process and diff detail to decide whether follow-up action, such as reverting the change or investigating the account involved, is needed.