Step‑by‑Step Guide: Configuring Custom File Integrity Monitoring Alerts in Imunify360 for Critical Core Directories

In today’s threat-laden environment, the integrity of a web server’s core directories can mean the difference between a clean site and a full-blown compromise. While Imunify360’s built-in File Integrity Monitoring (FIM) is effective at flagging changes, many administrators need finer-grained alerts that focus only on the most critical paths—such as /etc, /var/www/html, or custom application folders. This guide walks you through configuring custom FIM alerts in Imunify360, ensuring you receive timely notifications the moment something unexpected touches the files that matter most.

Why Custom File Integrity Monitoring Matters

Imunify360’s default FIM continuously hashes every file on the server and compares it against a trusted baseline. However, this blanket approach can:

• Generate alert fatigue—hundreds of benign changes (log rotation, CMS updates) drown out genuine threats.
• Cause performance overhead—scanning the entire filesystem consumes CPU and I/O, especially on busy shared hosts.
• Miss critical focus—directories that house configuration files, executable scripts, or sensitive data may not receive the heightened scrutiny they deserve.

By narrowing the scope to core directories and tailoring alert thresholds, you gain a clearer, faster signal-to-noise ratio and reduce server load.

Prerequisites

1. Root or sudo access to the server running Imunify360.
2. Imunify360 version 7.0 or newer (custom FIM rules were introduced in this release).
3. Basic familiarity with the imunify360-cli utility and your preferred notification channel (email, Slack webhook, or Syslog).
4. A backup of the directories you plan to monitor, just in case a misconfiguration triggers false positives.

Step 1: Identify the Core Directories to Protect

Start by compiling a concise list of paths that, if altered, could compromise the server’s security or functionality. Typical candidates include:

• /etc – System configuration files.
• /var/www/html – Public web root.
• /usr/local/bin – Custom scripts and binaries.
• /home/*/public_html – User-level web roots on shared hosting.
• Application-specific folders, e.g., /opt/wordpress or /srv/docker.

Save these paths to a plain-text file for easy reference, e.g., /etc/imunify360/fim-targets.txt:

# /etc/imunify360/fim-targets.txt
/etc
/var/www/html
/usr/local/bin
/home/*/public_html
/opt/wordpress

Step 2: Create a Custom FIM Profile

Imunify360 allows you to define multiple FIM profiles, each with its own set of directories, alert thresholds, and notification methods. Create a new profile called core-monitor:

sudo imunify360-cli fim profile create core-monitor \
  --paths /etc,/var/www/html,/usr/local/bin,/home/*/public_html,/opt/wordpress \
  --hash-algorithm sha256 \
  --scan-interval 30

Flags explained:

• --paths – Comma-separated list of directories (wildcards are supported).
• --hash-algorithm – SHA-256 offers a strong balance between security and performance.
• --scan-interval – Minutes between each integrity scan (30 minutes is a safe default; lower it to 15 for ultra-sensitive environments).

Verify the profile:

sudo imunify360-cli fim profile list

Step 3: Define Alert Rules for the Profile

Imunify360 supports three primary rule types:

1. Modification – Any change to a file’s hash.
2. Deletion – A monitored file disappears.
3. Creation – A new file appears in a protected directory.

Configure the rules for core-monitor:

# Modification – Critical
sudo imunify360-cli fim rule add --profile core-monitor \
  --type modification --severity critical

# Deletion – High
sudo imunify360-cli fim rule add --profile core-monitor \
  --type deletion --severity high

# Creation – Medium (to catch rogue scripts)
sudo imunify360-cli fim rule add --profile core-monitor \
  --type creation --severity medium

To ignore certain file types (e.g., log files), add an exclusion pattern:

sudo imunify360-cli fim exclude add --profile core-monitor \
  --pattern "*.log"

Step 4: Configure Notification Channels

Imunify360 can push alerts to several endpoints. Choose the one that fits your workflow.

Email Notifications

sudo imunify360-cli notification email set \
  --profile core-monitor \
  --recipients admin@example.com,security@example.com \
  --subject "[Imunify360] Core Directory Integrity Alert"

Slack Webhook

First, create an incoming webhook URL in Slack (Settings → Apps → Incoming Webhooks) and then register it:

sudo imunify360-cli notification webhook add \
  --profile core-monitor \
  --url https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX \
  --format markdown

Syslog (for centralized logging)

sudo imunify360-cli notification syslog set \
  --profile core-monitor \
  --facility local5 \
  --severity warning

Test the channel to ensure delivery:

sudo imunify360-cli fim test-alert --profile core-monitor --type modification

Step 5: Perform an Initial Baseline Scan

Before monitoring begins, Imunify360 needs a trusted baseline. Run the first scan manually to avoid false positives on the next scheduled run:

sudo imunify360-cli fim scan --profile core-monitor --baseline

Review the scan log for any unexpected changes:

sudo tail -n 20 /var/log/imunify360/fim.log

If the log shows legitimate modifications (e.g., a recent CMS update), accept them as the new baseline or exclude the specific files/folders.

Step 6: Automate and Verify Ongoing Monitoring

Imunify360 automatically schedules scans based on the interval you set. Verify the cron job:

sudo crontab -u imunify360 -l

You should see a line similar to:

*/30 * * * * /usr/bin/imunify360-cli fim scan --profile core-monitor >/dev/null 2>&1

Simulate a real change to validate the end-to-end flow. For example, create a dummy file in /var/www/html:

sudo touch /var/www/html/test-alert.txt

Within the next scan window (or immediately if you run a manual scan), you’ll receive a “creation” alert with the severity you defined. Clean up after testing:

sudo rm /var/www/html/test-alert.txt

Best Practices for Ongoing Maintenance

• Review alerts weekly—even with custom rules, occasional false positives happen after legitimate updates.
• Update the baseline after patches—re-run the baseline scan whenever you apply OS or application updates to avoid churn.
• Rotate notification credentials—if you use webhooks or API keys, rotate them every 90 days.
• Combine with other Imunify360 modules—pair FIM with the Web Application Firewall (WAF) and malware scanning for layered defense.

Conclusion

Custom file integrity monitoring in Imunify360 empowers you to focus on the directories that truly matter, cut through alert noise, and react instantly when something amiss occurs. By following the six steps outlined above—identifying critical paths, creating a dedicated profile, fine-tuning alert rules, wiring up reliable notifications, establishing a trusted baseline, and validating the workflow—you’ll have a robust, low-overhead safeguard that fits seamlessly into any security operations routine.

Remember, security is a process, not a set-and-forget configuration. Periodically revisit your monitored directories, adjust thresholds as your environment evolves, and keep your notification channels current. With a well-maintained custom FIM setup, you’ll stay one step ahead of attackers and maintain the integrity of your core web assets with confidence.