Forum Discussion
shocko
Apr 23, 2022Iron Contributor
File Integrity Monitoring
I have a large estate of Windows Enterprise 10 21H2 machines on-prem (not Azure VMs) running Windows Defender AV with endpoint protection enabled. I wish to monitor certain file for changes. I used d...
- May 12, 2022
This feature requires Defender for Servers Plan 2.
Defender for Servers includes a Defender for Endpoint license, but also includes several other unrelated features, such as this File Integrity Monitoring.
Defender for Servers can be used with Azure Arc on machines outside of Azure,
but this does not support Windows Clients, so I don't think this works in your case.
https://docs.microsoft.com/en-us/azure/azure-arc/servers/prerequisites#supported-environments (Even if you could use Defender for Servers, this would be very expensive since you would be billed per machines)
jbmartin6
May 13, 2022Iron Contributor
You could probably use plain old file system auditing for a good portion of this goal.
shocko
Jul 11, 2022Iron Contributor
File system auditing easily bypassed by Malware. I think I might have to back to good old OSSEC ....
- jbmartin6Jul 12, 2022Iron ContributorDo you have any links about malware bypassing file system auditing? I'm not familiar with those techniques. I just did some searching but only managed to get more information about auditing.