Captures the SHA-256 hash of monitored files in their clean, initial state. Any change is compared against this baseline.
MODULES / FIM
Tamper-proof evidence for file integrity
FIM
Monitor critical system files, web directories, and configurations with SHA-256 integrity checks. Stop unauthorized changes instantly.
- SHA-256
- ISO 27001
- KVKK
[ PURPOSE & VALUE ]
What does FIM do?
Advanced persistent threats (APTs) or an attacker who has already breached your system typically modify critical OS configuration files (Linux /etc/passwd, the Windows registry, etc.) or quietly drop webshell (backdoor) files into your website's directories to maintain persistence. NextPcap's FIM (File Integrity Monitoring) module watches these critical directories on your servers, detecting every unauthorized file creation, deletion, or edit within milliseconds.
[ FEATURES ]
What FIM delivers
Shows exactly which lines were deleted or which malicious command line was added in a modified configuration file, with green/red color coding.
Instantly catches newly added .php or .asp files that could be webshells dropped into your web root.
[ HOW IT WORKS ]
Live in three steps
Reference hash values are captured for the files to be monitored.
Differences are found via periodic or event-triggered scans.
Changes are recorded with a timestamp and hash.
[ RELATED MODULES ]
Works together with FIM
[ FAQ ]
Frequently asked questions about FIM
It instantly detects newly added files like .php or .asp in your web root and raises an alert.
Yes — the diff view shows added, deleted, and modified lines with green/red color coding.
See FIM live
Headquarters: Ankara · iletisim@nextpacketcapture.com