Topics Discussed

Enable Trend Sub-Agent

As a prerequisite to installing File Integrity Monitoring, you must install the Trend sub-agent. Use the following commands to manage the Trend sub-agent.

Recommendation Scans

One of the features available in Agent 3.0 is Recommendation scans. Recommendation scans provide a good starting point for establishing a list of rules that you should implement. During a recommendation scan, the Armor Agent scans the operating system for installed applications, the Windows registry, open ports, and more. To take advantage of Recommendation scans, turn on Ongoing Recommendation scans in the Toolbox. 

Install Trend Sub-Agent:

Windows: C:\.armor\opt\armor.exe trend install
Linux: /opt/armor/armor trend install

Uninstall Trend Sub-Agent:

Windows: C:\.armor\opt\armor.exe trend uninstall
Linux: /opt/armor/armor trend uninstall 

Trend Sub-Agent Status:

Windows: C:\.armor\opt\armor.exe trend status
Linux: /opt/armor/armor trend status

Turn On Recommended Scans:

Windows: C:\.armor\opt\armor.exe trend ongoing-recommendation-scan on
Linux: /opt/armor/armor trend ongoing-recommendation-scan on

Turn Off Recommended Scans:

Windows: C:\.armor\opt\armor.exe trend ongoing-recommendation-scan off
Linux: /opt/armor/armor trend ongoing-recommendation-scan off

Schedule a Recommended Scan (Runs on Next Trend Sub-Agent Heartbeat):

Windows: C:\.armor\opt\armor.exe trend recommendation-scan
Linux: /opt/armor/armor trend recommendation-scan

Set Recommendation Scan Interval:

Windows: C:\.armor\opt\armor.exe trend set-recommendation-scan-interval <interval>
Linux: /opt/armor/armor set-recommendation-scan-interval <interval>

 Options are  "24 Hours" "2 Days" "3 Days" "7 Days" "2 Weeks" "3 Weeks" "4 Weeks"

Get Recommendation Scan Interval:

Windows: C:\.armor\opt\armor.exe trend get-recommendation-scan-interval
Linux: /opt/armor/armor trend get-recommendation-scan-interval

Trend Sub-Agent Help

Windows: C:\.armor\opt\armor.exe trend help
Linux: /opt/armor/armor trend help

Enable File Integrity Monitoring Service

Use the following commands to manage the File Integrity Monitoring service.

Turn On File Integrity Monitoring:

Windows: C:\.armor\opt\armor.exe fim on
Linux: /opt/armor/armor fim on

Optional Parameters
Windows: C:\.armor\opt\armor.exe fim on auto-apply-recommendations=on
Linux: /opt/armor/armor fim on auto-apply-recommendations=on

Windows: C:\.armor\opt\armor.exe fim on auto-apply-recommendations=off
Linux: /opt/armor/armor fim on auto-apply-recommendations=off

Turn Off File Integrity Monitoring:

Windows: C:\.armor\opt\armor.exe fim off
Linux: /opt/armor/armor fim off

List of Assigned FIM Rules on Policy:

Windows: C:\.armor\opt\armor.exe fim list-assigned-rules
Linux: /opt/armor/armor fim list-assigned-rules

Assign FIM Rules:

Windows: C:\.armor\opt\armor.exe fim assign-rules
Linux: /opt/armor/armor fim assign-rules

Un-Assign FIM Rule:

Windows: C:\.armor\opt\armor.exe fim unassign-rule
Linux: /opt/armor/armor fim unassign-rule

File Integrity Monitoring Help

Windows: C:\.armor\opt\armor.exe fim help
Linux: /opt/armor/armor fim help

Add Custom Filepath Rule

Windows: C:\.armor\opt\armor.exe fim add-custom-filepath-rule "<name>,<filepath>,<description>"
Linux: /opt/armor/armor fim add-custom-filepath-rule "<name>,<filepath>,<description>"

Update Custom Filepath Rule

Windows: C:\.armor\opt\armor.exe fim update-custom-filepath-rule "<id>,<name>,<filepath>,<description>"
Linux: /opt/armor/armor fim update-custom-filepath-rule "<id>,<name>,<filepath>,<description>"

Delete Custom Filepath Rule

Windows: C:\.armor\opt\armor.exe fim delete-custom-filepath-rule "<id>"
Linux: /opt/armor/armor fim delete-custom-filepath-rule "<id>"

Get Custom Filepath Rule

Windows: C:\.armor\opt\armor.exe fim get-custom-filepath-rule "<id>"
Linux: /opt/armor/armor fim get-custom-filepath-rule "<id>"

View FIM Data

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
2. Click File Integrity Monitoring.

To learn how the overall FIM status is determined, see Understand FIM data.

Understand FIM Data

In the File Integrity Monitoring screen, the dashboard displays the various FIM statuses of your virtual machines (or hosts):

• Green indicates a virtual machine in a Secured FIM status.
• Yellow indicates a virtual machine in a Warning FIM status. 
• Red indicates a virtual machine in a Critical FIM status.

Armor determines the status of FIM based on how long FIM has been offline.

• If FIM is offline for 2 to 7 days, then the FIM status changes from Secured to Warning. 
• If FIM is offline for 8 days or more, then the FIM status changes from Warning to Critical. 
  
  

View Detailed FIM Data

The File Integrity Monitoring details screen displays the changes that has been detected in certain files in your virtual machine. This screen only shows data for the last 90 days. 

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security. 

2. Click File Integrity Monitoring.

3. Locate and select the desired virtual machine. 

Export FIM Data

To export the data: 

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security. 
2. Click File Integrity Monitoring.
3. (Optional) Use the filter function to customize the data displayed. 

4. Below the table, click CSV. You have the option to export all the data (All) or only the data that appears on the current screen (Current Set). 

   Function	Data Displayed	Notes
   CSV	VM Name, VM Provider, IP Address, OS, FIM Agent Status Fixed, FIM Agent Version, FIM Last Communication Date	A blank entry indicates that the action has never taken place.

Log Search for File Integrity Monitoring

Users can search for FIM events in Log Search. For instructions on how to access and use Log Search, please see our documentation here. 

An example of FIM logs can be seen below: 

For a full list of Log Search fields and descriptions, please visit our glossary here. 

Was this helpful?

Your Rating:

Thanks for voting!

Please Wait

Results:

15

rates