Every file change, attributed.
Not just detected.
Legacy file integrity monitoring tells you a file changed at 03:14. It cannot tell you which database session did it, or whether that matters. We watch datafiles, transaction logs, backups, configs, and keystores from the collector you already deploy — then tie every change to the user and the queries behind it.
The files that actually matter
on a database host
Generic file integrity monitoring watches system paths and treats a database like any other server. These are the eight areas where a change is either an incident or an audit finding.
Datafiles and tablespaces
The files your data actually lives in. A datafile copied, moved, or opened by a process that is not the database engine is one of the clearest exfiltration signals there is — and one that query-level auditing alone cannot see.
Redo, WAL, and transaction logs
Truncated or deleted transaction logs are how someone erases their tracks. We baseline rotation so the routine churn is silent and a genuine deletion is not.
Backups, dumps, and exports
pg_dump output, .bak files, expdp dumps, CSV exports. A backup written to an unexpected path, or read by an account that has never touched one, surfaces immediately.
Configuration files
postgresql.conf, my.cnf, pg_hba.conf, listener.ora, init parameters. Auditing being switched off is itself an audit event — and one that most tooling silently misses.
Binaries, libraries, and extensions
Engine binaries, shared library paths, and installed extensions. A swapped binary or an unexpected .so on the preload path is a compromise, not a change.
Keystores, wallets, and certificates
TLS material, Oracle wallets, and keystore files. Track access and modification, and get warned before certificates expire rather than during the outage.
Scheduled jobs and cron
crontab entries, systemd timers, and in-database schedulers. Persistence is usually established by adding a job, and a new job nobody requested is worth a page.
The audit trail itself
The audit log is the first thing an attacker edits. Its integrity is monitored with the same mechanism as everything else, then written to append-only storage so alteration is detectable rather than deniable.
Hash, baseline, correlate
under 1% CPU
XXH3 content hashing
Every watched file carries a content hash from the same hash-first pipeline the query auditing uses. Comparison is a hash check, not a byte-by-byte diff, which is why watching thousands of files costs under 1% CPU.
Baseline and drift
A known-good snapshot is taken per host and per engine. Everything after is measured against it, so you are always looking at drift from an approved state rather than a raw stream of file events.
Permissions and ownership
Content is only half of integrity. Mode, owner, group, and ACL changes are tracked too — a datafile quietly made world-readable never changed a single byte.
Attribution, not just detection
This is the part standalone FIM cannot do. Because the same platform holds the query trail, a file change is correlated with the database session, OS user, and statements running at that moment. You get who and why, not just what and when.
Altered records are detectable,
not deniable
A change record is only worth as much as its own integrity. File events land in append-only, immutable storage — S3 with Object Lock, Azure Immutable Blob, or an append-only mount for self-hosted deployments — and each record carries a verification hash. If the evidence has been touched, verification fails and says so.
- Append-only and WORM storage targets
- Per-record hash verification
- Retention windows to 7 years
- Monitoring on the audit trail itself
The requirement your auditor cites,
mapped to the control
Integrity monitoring is named in most frameworks. These are the exact articles, with the evidence that satisfies them.
Automated Audit Trails
MUST implement automated audit trails for all system components to reconstruct events.
File-level change detection across cardholder-data hosts, reconstructable per event and linked to the individual who caused it.
Criminal Penalties
Knowingly altering or destroying records is a federal crime. REQUIRES tamper-evident audit logging.
Hash-verified integrity on financial datafiles and the audit trail, with append-only retention so alteration or destruction is provable.
Integrity Controls
MUST implement policies and procedures to protect ePHI from improper alteration or destruction.
Continuous integrity monitoring on every file holding ePHI — datafiles, backups, and exports — with alerting on improper alteration.
Working to a framework not listed here?See all 57 frameworks we map to.
Already in the collector
you deploy anyway
There is no second product here. Same collector, same console, same policy engine, same alert routing, same role-based access. File activity monitoring is a toggle, not a procurement cycle. Buying it separately means another agent, another console, another renewal, and another set of credentials to manage.
Cost
No separate FIM licence, no per-host agent fees, no second renewal to defend. File activity monitoring is part of the platform, so the marginal cost of turning it on is zero.
Ease of use
Pick a policy template, choose which paths matter, and you are monitoring. One Helm chart, minutes of work — not a rollout project with a per-host agent inventory.
Runs local
Self-hosted or air-gapped, file metadata and hashes never leave your network. Sensitive values are masked before anything egresses, and there is no cloud dependency to get an exception for.
AI that cuts the noise
Behavioral baselining learns what normal file churn looks like per host. The nightly backup writing 400 files is silent; one datafile copied to /tmp at 02:00 by an account that has never done it is a critical alert.
Cited by 31 of the 57 frameworks
we map
Each one below has at least one cited requirement whose evidence this capability produces. Follow any framework through to see the exact articles and why.
See it on your own estate
Enter your business email and we'll show you file activity monitoring running against a database like yours — including what your current FIM setup is not catching.