Security Compliance

FIM related Windows events for SEM

This article provides information about the SEM file integrity monitoring (FIM) connector as it watches certain events.

First published date

10/9/2018 6:52 PM

Last published date

10/9/2018 6:52 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
This article provides information about Windows events similar to FIM connector events logged as it watches certain events on the client machine.

Product section

Security Event Manager

Resolution

Here are the Windows events which are used for file integrity monitoring:

4656 A handle to an object was requested
4657 A registry value was modified
4658 The handle to an object was closed
4659 A handle to an object was requested with intent to delete
4660 An object was deleted
4661 A handle to an object was requested
4662 An operation was performed on an object
4663 An attempt was made to access an object

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.