Enginsight File Integrity Monitoring (FIM) is a component of the Enginsight Cybersecurity Platform that monitors system-critical files and folders for unauthorized changes. It is designed to detect modifications to files and directories across Windows, Linux, and macOS systems, and is available as both a SaaS and on-premises deployment. FIM operates by generating checksums of files and comparing them against known, trusted versions to verify integrity. It records who made changes, what was changed, and when, providing an audit trail for both security and compliance purposes. Key functional areas include: - **Ransomware Detection:** Files and directories are assigned criticality levels, enabling the system to flag unusual or clustered activity patterns indicative of ransomware attacks. - **Unauthorized Change Detection:** Administrators receive alerts when suspicious file changes occur, such as modifications to SSH configurations. - **File Recovery:** Hash values are used to support rapid recovery of original files after tampering. - **Compliance Support:** FIM logs provide evidence of system and file integrity for regulatory audits and help organizations adhere to security policies. - **Error Analysis & Troubleshooting:** Access logs allow administrators to review changes within a specific timeframe to identify misconfigurations or sources of system failures. - **Insider Threat Protection:** Suspicious internal activity is detected and reported immediately. The product is marketed as a foundation for forensic investigations and as an early-warning mechanism for detecting security incidents involving file-level changes.