> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/file-integrity-monitoring.md).

# File Integrity Monitoring

With Enginsight's File Integrity Monitoring (FIM) feature, you can monitor the integrity of your files and directories in real time on all hosts on which [Pulsar is installed](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-components/pulsar.md). Monitoring is based on the operating system's file system events, which allows you to detect manipulation or access immediately.

To do this, an initial footprint is created that consists of hash values and metadata and that is used as the basis for detecting changes to files and directories. This footprint is stored as a reference both on the Enginsight Application Server and as a read-only reference on Pulsar to prevent manipulation.

Create [rules](/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/rules.md) for FIM that you can use to detect [file operations](/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/file-operations.md), such as changing, adding, or deleting files.

***

## Important Notes

**Restrictions for Using the FIM Feature**

* FIM is not available for files and folders on drives that do not support access auditing. This applies, for example, to encrypted volumes mounted with VeraCrypt. You can check whether FIM is supported on a drive in the **Properties** of a file located on that drive. If access auditing is possible, the **Security** tab is available there.
* If you want to monitor network shares using FIM, we recommend that you set up FIM directly on the server that provides the share. This prevents increased system load on all devices that access the share.

**Using FIM on macOS**

* **Please note**: Using FIM on macOS hosts is possible, but it is **not officially supported** by Enginsight. Use it **at your own risk**.
* If you still want to use FIM on macOS, you must first manually enable **Full Disk Access** on your host:
  1. Navigate to **System Settings** → **Privacy & Security** → **Full Disk Access** on your macOS host.
  2. Enable the toggle next to **Enginsight Pulsar** so that Pulsar can access files and directories.

***

## FIM: Menu Structure

Under **Hosts** → **File Integrity Monitoring**, you will find various options for monitoring the integrity of your files and directories.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **File Integrity Monitoring** menu item to expand or collapse the corresponding submenu.

The following submenu items are available:

{% columns %}
{% column width="33.33333333333333%" %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FHN5vdwzIgGdxmz6er6Q9%2FEnginsight-EN-Menu-Hosts-FIM.jpg?alt=media&amp;token=5d57c5b7-41bf-4a10-9af1-70785ff018e9" alt=""><figcaption></figcaption></figure>
{% endcolumn %}

{% column width="66.66666666666667%" %}

* [Dashboard](/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/dashboard.md)
* [File Operations](/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/file-operations.md)
* [Rules](/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/rules.md)
  {% endcolumn %}
  {% endcolumns %}

<i class="fa-grip-dots-vertical">:grip-dots-vertical:</i> Click and hold the **File Integrity Monitoring** menu item to move it, including all submenu items, within the menu tree using drag and drop.

***