FIM Recommendations

File Integrity Monitoring (FIM) allows you to audit changes to critical files and folders for compliance reasons on Windows systems running agent version 2.5.3.8 or later. When you enable FIM, you can only monitor a specific set of extensions to prevent data collection overload on both the Insight Agent and InsightIDR. Files (such as log files) that are frequently changed by applications or the operating system are “noisy” and make it difficult for InsightIDR to identify an attack because they produce an overabundance of events.

Extensions Monitored

InsightIDR allows you to monitor the following extensions:

• .bat
• .cfg
• .conf
• .config
• .dll
• .exe
• .ini
• .sys

Adding More Extensions

InsightIDR will “ignore” any other files you configure for monitoring that do not have one of the allowed extensions. However, you can request that certain file extensions be allowlisted if you determine that they are necessary for your organization. To request an extension allowlist, contact support.

FIM Considerations

As you monitor more files and folders, CPU usage increases proportionally.

Do not monitor all available file events. Recall that InsightIDR FIM only monitors for the following events, and will ignore all other events from the Insight Agent:

• Create files / write data
• Create folders / append data
• Delete subfolders and files
• Delete

Monitoring Recommendations

The intent of FIM is to track and audit file modifications solely on critical business files on critical systems only. Rapid7 recommends not monitoring from C:\ recursively.

Rapid7 recommends monitoring the Windows Microsoft Critical System Files, which include:

• C:\autoexec.bat
• C:\boot.ini
• C:\config.sys
• C:\Program Files\Microsoft Security Client\msseces.exe
• C:\Windows\explorer.exe
• C:\Windows\regedit.exe
• C:\Windows\system.ini
• C:\Windows\System32\userinit.exe
• C:\Windows\win.ini