General questions

[okynos]

Do you have some questions? We will solve any related doubt.

[thisnugroho]

Hello, first of all, thank you for putting effort into this project. It's really impressive.

I apologize if I'm not in the right place to ask this, but I have some questions. Is it possible to find out who created or edited the file?

[okynos]

Hello @thisnugroho,

Hello, first of all, thank you for putting effort into this project. It's really impressive.

Thanks for the words, really appreciated.

I apologize if I'm not in the right place to ask this, but I have some questions. Is it possible to find out who created or edited the file?

No worries. I created FIM project and all the files that you can see on GitHub. Do you have any problem or maybe you want to edit something? What file do you mind? I can help you with it.

[thisnugroho]

You're welcome 😉

{
  "checksum": "a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9402 c3ac558f500199d95b6d3e301758586281dcd26",
  "detailed_operation": "CREATE_FILE",
  "file": "/var/www/shell.php",
  "fpid": 16662,
  "hostname": "localhost",
  "id": "c9d7ee84-1d96-41d5-9e39-2791592ee153",
  "labels": [],
  "node": "FIM",
  "operation": "CREATE",
  "system": "linux",
  "timestamp": "1698591757187",
  "version": "0.4.9"
}

I am looking for the following details from the logs:

1. Which file was created, edited or deleted? ✅
2. When did the action occur? ✅
3. Who created/edited/deleted the file? ❓
4. Size of the file ? ❓

Do you know how I can get an answer from number 3 and 4 ?

[okynos]

3. Who created/edited/deleted the file? ❓

To know who performed the action you will need to enable the Audit feature and set up the required directory to monitor. The system requires the Audit to provide user information. The default inotify feature does not provide such information. Take a look at https://documentation.achiefs.com/docs/configuration-file.html#audit for more information.

4. Size of the file ? ❓

Currently, FIM does not provide the file size of an event. But I have to say that I have reviewed the code, and it is not hard to include. I will include it as soon as possible.

[thisnugroho]

Hello, I attempted to install it on my other server, but it gave me an error message.

dpkg: error processing archive fim.deb (--install):
 package architecture (amd64) does not match system (arm64)
Errors were encountered while processing:
 fim.deb

I need usingHetzner server, which has an ARM64 architecture. Can you help me with this?

[okynos]

Hello @thisnugroho,

I'm struggling with an AARCH64 architecture compilation, for this reason I did not upload the RPM and Debian ARM packages.
I have compiled this one meanwhile:
DEB ARM64
Give it a try and let me know anything you need. Thanks!

[thisnugroho]

Hello,

Cool it's working now, Thank you so much 👍 😄

[okynos]

Hello @thisnugroho we have published officially the v0.4.10 if you wish to test it out. Thanks.

[thisnugroho]

Thank you so much ✨

[okynos]

Hello @thisnugroho, I hope all is going fine. I merged the #134 issue into the main branch (0.5.0). I want to ask you. Have you any requirements or feature requests that you may require to include in 0.5? Feel free to suggest anything you need. You can also check the issues list at https://github.com/Achiefs/fim/issues.

Thanks in advance, and have a nice day!

[thisnugroho]

Thank you so much,

i was wondering Is it a good idea to set notifications for when files that meet specific rules are created or exist? Or do you have any recommendations on how to accomplish that?

[okynos]

Do you mean something inside the document? Or something that surrounds the file? Do you want to produce an event when some regex is inside a document or if one file obtains execution permissions, plus it is executed?
In summary, could you give me some examples? Thanks!

[thisnugroho]

for example If there is a new file with the extension *.php in a specific folder, I would like to receive a notification.

[okynos]

Ok I got that. I will create an issue to include it in 0.5. Feel free to include any corrections when the issue is ready.

Again, thanks for your time and words!

[thisnugroho]

Sure, thank you so much

You are so amazing ✨ !

[zbalkan]

Do you have plans to provide a default backend server? Or do you want to keep this as a host-only solution?

[zbalkan]

I use Wazuh for all my needs. But there are some friends an acquaintances in need of a FIM, while keeping their SIEM in place. Therefore, this tool may help by either sending logs to the SIEM agent locally, or building a backend and alerting on top of it. You mentioned elasticsearch and OpenSearch. These days I am testing Quickwit, a rust based immutable Document database. It looks less stable but more lightweight than other options. Instead of sending all logs to SIEM, it would make sende to add a middleman (elasticsearch, OpenSearch or Quickwit) and sending only alerts triggered by them to SIEM would make things simpler. I have many FIM rules in Wazuh, but they are actually not security rules. They are just filtering important file changes. Delegating this filtering to a database would make more sense. And it would also minimize the SIEM costs since many licenses are calculated by EPS or storage.

[okynos]

So If I understand it. You suggest something in between OpenSearch and Wazuh to filter related security events? and then only take action where specific events are received at the OpenSearch level? OpenSearch can't forward events right?
Maybe we will need a backend runtime that receives the events and produce a security event. Thinking on it FIM will only produce events you may want to know (Monitoring critical paths) then you can take a decision when you receive the event at OpenSearch stage.
Maybe I sound confused. It's just because I'm brainstorming on it.

[zbalkan]

I mean something dedicated like OpenSearch. People spend a lot for a SIEM, for instance Splunk. So they don't want to change that. Something in between Splunk and FIM, that would store the change logs, but send only alerts matching some rules. For instance they may just need /etc for configurations, /opt for their own applications on Linux, etc. I have rules for system cryptography settings in RHEL, for instance. Then, only these alerts may be sent to SIEM, while other logs would be kept in the OpenSearch, Elasticsearch instance. Do you plan to leave this to the users to build own their stack? Or do you want to have a preconfigured setup?

[okynos]

Now I understand better the idea.
I know the users like to manage the events received. Your request will allow the users to process only the critical events at the indexer level.
However, I think the development of a SIEM will be out of the scope of this project and will need a common structure.
I have been thinking about that. How does it sound to you to have a package called FIM (File monitoring), another called EventResponse, another called LogReader (process logging) even another called Receiver (to process any module received events)?. With the mentioned schema we could manage users' events and then send them to the indexer.
I could develop those modules each one with separated schema and repository.

[zbalkan]

You don't have to send to Indexer directly. If you already have an agent, let's say Wazuh, we can read read FIM events whatever location configuration supports. That'd solve the log forwarding problem but not the filtering problem. That must be solved locally then. It became a configuration management issue for the user. User can use Ansible, Puppet, Chef or Group Policy to deploy rules.yaml to the endpoints. The SIEM of the user can handle the rest. If that's the design decision, it's better to write documents for users to help integration for forwarding FIM to SIEM agent, and rules/queries for FIM logs in Wazuh, Splunk, Elasticsearch+Elastalert, etc.

The other way requires a lightweight SIEM. It would simplify the life for users but it will require development efforts.

[nicolascharbonnier]

HowTo change date format ? (Linux)
i see : /etc/fim/index_template.json
"timestamp": { "type": "date" },

is it possible to get it readable human format ?

[okynos]

Hello @nicolascharbonnier

When you ingest an event into OpenSearch you will get a human readable format, I attach you an example:

If you will process the events.json file directly you can use any of Linux date conversion commands because it is a standard Unix timestamp.
Tell me if it helps you.

[nicolascharbonnier]

Hey, thx for reply so fast.
i don't use OpenSearch (for the moment) but i think, i will.

[zodiacnet]

Hi everybody,
first of all, FIM its a nice application!, I've used others on the past but had high impact on the disk or cpu, so far the short time I've used it seems to run very smooth and without much impact!, the reasom I'm here today is because I'm trying to enable audit feature, I've already installed auditd and confirmed that auditctl it's installed, but when I restart FIM it says
Auditctl command error: No such file or directory (os error 2)
I've reviewed what command tries to run when the error happens and seems like it's running "which auditctl" to find the auditctl path, I've even added the PATH env var to the service but I had no luck, do you have an idea about how to resolve this issue?
thank you in advance!

[zodiacnet]

solved!, just reviewed the code and was looking it on /usr/sbin/auditctl and on my system was on /sbin/auditctl so just created a symlink and it worked!

[okynos]

Hello @zodiacnet

I'm glad that you solved it.
Thanks for your feedback, which system do you use? I want to review the error.

[zodiacnet]

oh @okynos I forgot to add that detail on the ticket!
I was using Ubuntu 18.04.6 LTS (pretty old hehe)