In a previous blog, we presented NIST’s benchmark definition of integrity monitoring.

The conclusion was clear: Many vendor claims of file integrity monitoring (FIM) capabilities do not match this definition.

Change detection across system components, including files, is crucial and implemented in many tools, including EDR/XDR. However, while these systems often claim FIM capabilities, file change detection alone falls short of true FIM.

*** This is a Security Bloggers Network syndicated blog from Cimcor Blog authored by Dan Schaupner. Read the original post at: https://www.cimcor.com/blog/fim-test-a-method-for-distinguishing-true-fim-capabilities