Cloud-based file integrity monitoring
A cloud-based file integrity monitoring service identifies content changes to a computer file. An endpoint cybersecurity agent monitors its host client device for read/write and other operating system events associated with the computer file. When the endpoint cybersecurity agent detects each operating system event, the endpoint cybersecurity agent captures and reports, in real time or near real time, a snapshot of the file content representing the computer file. So, as the host client device changes the computer file with each operating system event, the endpoint cybersecurity agent uploads timestamped snapshots of the file content to a cloud-based file integrity monitoring service. The cloud-based file integrity monitoring service stores each snapshot of the file content, thus logging a change history for the computer file. The cloud-based file integrity monitoring service may thus retrieve and analyze different snapshots at different points in time, thus quickly identifying the content changes to the computer file.
1 . A method executed by a computer system for a cloud-based file integrity monitoring (FIM) service, comprising:
receiving, by the computer system, a file content associated with a computer file, the file content uploaded by an endpoint cybersecurity agent to the cloud-based FIM service in response to detecting an event;
determining, by the computer system, a cybersecurity risk in response to a content change to the computer file based on different file contents uploaded by the endpoint cybersecurity agent to the cloud-based FIM service;
determining, by the computer system, a historical file content associated with the computer file stored prior to the event;
sending, by the computer system, the historical file content stored prior to the event to the endpoint cybersecurity agent; and
rolling back, by the computer system, a safe version of the computer file by instructing the endpoint cybersecurity agent to restore the historical file content stored prior to the event.
2 . The method of claim 1 , further comprising determining a content difference between the different file contents.
3 . The method of claim 1 , further comprising determining a content difference between the different file contents by comparing the different file contents uploaded by the endpoint cybersecurity agent to the cloud-based FIM service.
4 . The method of claim 1 , further comprising sending a content difference between the different file contents to the endpoint cybersecurity agent as a service response of the cloud-based FIM service.
5 . The method of claim 1 , further comprising distributing a FIM configuration to a client device hosting the endpoint cybersecurity agent.
6 . The method of claim 1 , further comprising determining a file system path associated with the computer file based on at least one of the different file contents.
7 . The method of claim 1 , further comprising decompressing at least one of the different file contents.
8 . The method of claim 1 , further comprising decrypting at least one of the different file contents.
9 . The method of claim 1 , further comprising containerizing the different file contents.
10 . A computer system for a cloud-based file integrity monitoring (FIM) service, comprising:
at least one central processing unit; and
at least one memory device storing instructions that, when executed by the at least one central processing unit, perform operations, the operations comprising:
receiving different timestamped byte file contents associated with a computer file, each one of the different timestamped byte file contents uploaded by an endpoint cybersecurity agent to the cloud-based FIM service in response to detecting an FIM event;
identifying a byte difference between the different timestamped byte file contents uploaded by the endpoint cybersecurity agent to the cloud-based FIM service;
in response to the identifying of the byte difference between the different file contents, determining the byte difference indicates a potential cybersecurity risk associated with the computer file;
in response to the determining that the byte difference indicates the potential cybersecurity risk, determining a safe historical file content of the different timestamped byte file contents stored prior to the FIM event;
sending the safe historical file content stored prior to the FIM event to the endpoint cybersecurity agent; and
rolling back to the safe historical file content by instructing the endpoint cybersecurity agent to restore the safe historical file content stored prior to the FIM event.
11 . The computer system of claim 10 , wherein the operations further comprise determining the content difference between the different file contents by comparing the different file contents uploaded by the endpoint cybersecurity agent to the cloud-based FIM service.
12 . The computer system of claim 10 , wherein the operations further comprise outsourcing the different file contents from the cloud-based FIM service to a service provider that determines the content difference.
13 . The computer system of claim 10 , wherein the operations further comprise distributing a FIM configuration to a client device hosting the endpoint cybersecurity agent.
14 . The computer system of claim 10 , wherein the operations further comprise determining a file system path associated with the computer file.
15 . The computer system of claim 10 , wherein the operations further comprise decompressing at least one of the different file contents.
16 . The computer system of claim 10 , wherein the operations further comprise decrypting at least one of the different file contents.
17 . The computer system of claim 10 , wherein the operations further comprise containerizing the different file contents.
18 . A memory device storing instructions that, when executed by at least one central processing unit, perform operations for a file integrity monitoring (FIM) service, comprising:
receiving FIM events generated by an endpoint cybersecurity agent and sent via a cloud computing environment to the FIM service;
containerizing file contents read from the FIM events generated by the endpoint cybersecurity agent;
determining a content difference between the containerized file contents read from the FIM events generated by the endpoint cybersecurity agent;
in response to the determining of the content difference between the containerized file contents, determining a content change associated with a computer file;
determining the content change associated with the computer file represents a cybersecurity risk;
retrieving a safe historical file content associated with the computer file stored prior to an FIM event of the FIM events that represents the cybersecurity risk;
sending the safe historical file content stored prior to the FIM event to the endpoint cybersecurity agent; and
rolling back to the safe historical file content by instructing the endpoint cybersecurity agent to restore the safe historical file content stored prior to the FIM event that represents the cybersecurity risk.
19 . The memory device of claim 18 , wherein the operations further comprise decompressing at least one of the containerized file contents.
20 . The memory device of claim 18 , wherein the operations further comprise decrypting at least one of the containerized file contents.