Frequently Asked Questions
What targeting scopes are available when creating a FIM configuration?
The Scope dropdown offers All Endpoints, Specific Endpoints, Specific Departments,
Specific Locations, Windows, Linux, and macOS. Choosing Specific Endpoints reveals
an Endpoints field where individual machines can be searched and added to the
configuration one at a time.
How do I monitor a Windows Registry key instead of files?
In the Monitoring Rule section, set Configuration Type to Registry (it defaults
to Files) and enter a Category label. Then add the key you want watched to
Include Paths using its full hive path, for example
`HKEY_CURRENT_USER\Software\FIMTest`. An optional Exclude Paths field is also
available for narrowing the scope.
What registry actions does FIM detect?
Based on the recorded test, FIM captured both Modify and Delete actions on the
watched key: a value being added, a value being changed, and the key ultimately
being deleted. The FIM Events dashboard includes a "Category wise Event Count"
chart that breaks activity down by action type.
What details are captured for each FIM registry event?
Expanding an event shows Type, Category, Event Time, Username, Process (full
path to the executable that made the change, e.g. powershell.exe), PID, whether
the value was hashed, a unique Event ID, the Host, and the specific Registry
Value affected.
Where can I review FIM activity after creating a configuration?
From FIM Configuration, use the View Events button to open FIM Events. This
view includes a File Integrity Monitoring Trends chart broken out by OS
(Windows, Linux, macOS), a Category wise Event Count chart, and a searchable,
expandable table of individual events per endpoint.
Can multiple FIM configurations be active at the same time?
Yes, each configuration has its own Status toggle in the FIM Configuration
list, so individual configurations can be enabled or disabled independently
without affecting the others.
