File Integrity Monitoring using Cortex via Corelation Rule

[T.Andriawan]

Dear all,

I'm looking for FIM on Linux (like etc/shadow),

I try with previous conversation use this query:

dataset = xdr_data

|filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME )

|filter lowercase(action_file_path) in ("/etc/*","/usr/local/share/*","/usr/share/*") and action_file_extension in ("conf","txt")

| fields action_file_name , action_file_path , action_file_type , agent_ip_addresses , agent_hostname, action_file_path

But i didn't see all of field, for the examples are the difference (object before and after) and then the process name like "/usr/sbin/sshd" or "/usr/sbin/userdel". How to show it on XQL Query? Thanks

[Anderson8816]

---

@T.Andriawan wrote:

Dear all,

I'm looking for FIM on Linux (like etc/shadow),

I try with previous conversation use this query:

dataset = xdr_data LaSRS Login

|filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME )

|filter lowercase(action_file_path) in ("/etc/*","/usr/local/share/*","/usr/share/*") and action_file_extension in ("conf","txt")

| fields action_file_name , action_file_path , action_file_type , agent_ip_addresses , agent_hostname, action_file_path

But i didn't see all of field, for the examples are the difference (object before and after) and then the process name like "/usr/sbin/sshd" or "/usr/sbin/userdel". How to show it on XQL Query? Thanks

---

You're right, the current XQL query doesn't capture the information you're looking for, like the difference between the object before and after a change or the process responsible.