Security Compliance

How File Integrity Monitor (FIM) handles actions performed on a network share in SEM

This article provides additional information that will be useful when configuring the SEM FIM (File Integrity Monitor) feature for use with a network share.

First published date

10/9/2018 5:35 PM

Last published date

10/9/2018 5:35 PM

Overview

This article provides additional information that will be useful when configuring the Security Event Manager (formerly Log & Event Manager) FIM (File Integrity Monitor) feature for use with a network share.

Product section

Security Event Manager

Resolution

The current version of KD (SWFsFltr.sys v1.1.0.12) handles actions performed on network share in a following way:

Action	SourceAccount in invoked event
FILE Create	User which performed action
FILE Read	NT AUTHORITY \ SYSTEM
FILE Write	User & NT AUTHORITY \ SYSTEM (one event from user + several from System) !IMPORTANT:** some applications invoke SYSTEM user events only!
FILE Delete	User which performed action
DIR Create	User which performed action
DIR Delete	User which performed action
DIR Read*	NT AUTHORITY \ SYSTEM
Permissions (ACL) Read	User & NT AUTHORITY \ SYSTEM
Permissions (ACL) Write	User which performed action
Metadata Read	User & NT AUTHORITY \ SYSTEM
Metadata Write	User which performed action Note: "Meta writes" follow "File writes" closely, use this to keep track of username when only SYSTEM user'ed "File writes" are generated by OS

Notes:

DIR Read events received by setting File Read op in Connector.
Depending on the application used to update file, some tend to invoke at least one user addressed events (notepad++), others spawn SYSTEM exclusively (e.g paint).

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.