Trigger an alert by email for File Integrity Monitoring FIM (add-on) events

SeanDeHarris — Tue, 18 Aug 2026 05:12:00 GMT

hello experts,

just exploring the new FIM module,

is it possible to trigger an email alerts for the FIM events?

will this FIM events be logged in one of the Dataset or preset?

cannot find any clue.

Thanks,

Re: Trigger an alert by email for File Integrity Monitoring FIM (add-on) events

susekar — Tue, 18 Aug 2026 15:06:54 GMT

Hello @SeanDeHarris ,

Greetings for the day.

Yes, it is possible to trigger email alerts for File Integrity Monitoring (FIM) events, and these events are logged within specific datasets in Cortex XDR.

1. Email Alerts for FIM Events

-FIM events are primarily ingested as telemetry data rather than immediate alerts.

Step 1: Generate an Alert: Create a BIOC or Correlation Rule that triggers an alert based on FIM telemetry.

Step 2: Configure Notification Forwarding: Configure email notifications via Settings → Configurations → General → Notifications (Notification Forwarding) or Automation Rules.

2. Dataset and Presets for FIM

Dataset: xdr_data
XQL Filter:dataset = xdr_data | filter fim_event = true

Console: Inventory → Endpoints → File Integrity Monitoring → Events

3. Key Requirements for FIM Logging

Licensing: XTH add-on license or Cloud Runtime license.
Agent Configuration:
- Enable Monitor and Collect Enhanced Endpoint Data.
- Enable Endpoint Information Collection.
Threshold: Default limit is 15,000 FIM events per agent per day. If exceeded, an Agent Audit Log is generated and further events may not be logged that day.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: Trigger an alert by email for File Integrity Monitoring FIM (add-on) events in Cortex XDR Discussions

Trigger an alert by email for File Integrity Monitoring FIM (add-on) events

Re: Trigger an alert by email for File Integrity Monitoring FIM (add-on) events