Detections
Analytics

8.1.3.5 Ensure that 'File Integrity Monitoring' Component Status is Set to 'On'

Information

File Integrity Monitoring (FIM) is a feature that monitors critical system files in Windows or Linux for potential signs of attack or compromise.

FIM provides a detection mechanism for compromised files. When FIM is enabled, critical system files are monitored for changes that might indicate a threat actor is attempting to modify system files for lateral compromise within a host operating system.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Remediate from Azure Portal

 - From the Azure Portal Home page, select Microsoft Defender for Cloud
 - Under Management select Environment Settings
 - Select a subscription
 - Under Settings > Defender Plans, click Settings & monitoring
 - Under the Component column, locate the row for File Integrity Monitoring
 - Select On
 - Click Continue in the top left

Repeat the above for any additional subscriptions.

Impact:

File Integrity Monitoring requires licensing and is included in the following plan:

 - Defender for Servers plan 2

See Also

https://workbench.cisecurity.org/benchmarks/24282

Item Details

Category: RISK ASSESSMENT

References: 800-53|RA-5, CSCv7|3.1

Plugin: microsoft_azure

Control ID: cbc3de9336373f50f4fb7c11802ddf57443de79a92d424d7de8659f0cdfb1b5d