Trigger an alert by email for File Integrity Monitoring FIM (add-on) events

[SeanDeHarris]

hello experts,

just exploring the new FIM module, 

is it possible to trigger an email alerts for the FIM events? 

will this FIM events be logged in one of the Dataset or preset?

cannot find any clue.

Thanks,

[susekar]

Hello @SeanDeHarris ,

Greetings for the day.

Yes, it is possible to trigger email alerts for File Integrity Monitoring (FIM) events, and these events are logged within specific datasets in Cortex XDR.

1. Email Alerts for FIM Events

-FIM events are primarily ingested as telemetry data rather than immediate alerts.

Step 1: Generate an Alert: Create a BIOC or Correlation Rule that triggers an alert based on FIM telemetry.

Step 2: Configure Notification Forwarding: Configure email notifications via Settings → Configurations → General → Notifications (Notification Forwarding) or Automation Rules.

2. Dataset and Presets for FIM

• Dataset: xdr_data
• XQL Filter:dataset = xdr_data | filter fim_event = true

• Console: Inventory → Endpoints → File Integrity Monitoring → Events
  
  

3. Key Requirements for FIM Logging

• Licensing: XTH add-on license or Cloud Runtime license.
• Agent Configuration:
  • Enable Monitor and Collect Enhanced Endpoint Data.
  • Enable Endpoint Information Collection.
• Threshold: Default limit is 15,000 FIM events per agent per day. If exceeded, an Agent Audit Log is generated and further events may not be logged that day.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar