The file_integrity integration can monitor for file changes, but does not include information about the user that modified the file. This is a significant visibility gap for security analysts and a heavily requested enhancement request.
Research needs to be done to determine how we can capture user information (and preferably the process too) within our FIM integration, and any underlying changes required.
As is mentioned in the linked documentation, today changes to files are watched using ReadDirectoryChangesW.
Meta issue #3310
The file_integrity integration can monitor for file changes, but does not include information about the user that modified the file. This is a significant visibility gap for security analysts and a heavily requested enhancement request.
Research needs to be done to determine how we can capture user information (and preferably the process too) within our FIM integration, and any underlying changes required.
As is mentioned in the linked documentation, today changes to files are watched using
ReadDirectoryChangesW.Meta issue #3310