This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 93%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJK%3C/text%3E%3C/svg%3E)
I have several ARC servers (installed on AWS EC2 vms) that have FIM deployed via quick fix for a security recommendation made by Defender for Cloud. The servers are running the Azure Monitoring Agent, there is a Data Collection Rule in place that targets a Log Analytics workspace in the same region. The Log analytics workspace has both the Security and Change Tracking solutions. When checking heartbeat or usage in the Logs for these machines, I can see that changetracking is sending heartbeat
FIM is not sending configuration changes for the files or registry keys specified by default, or added by me for testing. There are no logs in the ConfigurationChange table for the Log analytics workspace mentioned above (or at all as far as I can tell).
I'm not certain what else to check here, documentation is very sparse on this issue (apparently the only requirements being Defender for Servers 2 (which we have) and the Azure Monitor Agent being installed on the target servers (which it is)
I recommend reviewing the following instructions. Verify that the extension and DCR rule is setup and scoped correctly. Also note that this data is stored in a new workspace. I recommend requesting a support case through your Microsoft contacts or Services Hub if the problem persists.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-enable-ama
Hi Andrew, thank you for the quick answer.
I have already followed the steps for enabling FIM with AMA via the Defender for Cloud recommendation quick fix. I have also gone over the basic troubleshooting for AMA here (https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-troubleshoot-windows-arc#file-a-ticket) and as far as I can tell the DCR and AMA are set up on the various servers correctly (that is, all the expected log files are in place, processes are running, heartbeat is available in the workspace logs, and no errors appear to be present in the AMA log files)
As far as I can tell the data should be stored in the default workspace set up for FIM (we have not specified a custom workspace) as the heartbeats are accessible there - is that not correct? Should the workspace be indicated on the servers in the msconfig files for the DCR?
I will open a support ticket with Microsoft, although our current support level is directing me here
Not sure if this helps but let's walk through the process:
FIM is enabled as a quick fix. This adds the VM extension, creates a DCR rule, and creates a new workspace named defaultWorkspace-[subscriptionId]-fim.
This is not the same as the MDFC workspace.
The next step should be to open Workload Protections>FIM and enable the newly created workspace for FIM. This adds the change tracking solution to the workspace.
Next would be the creation of the new change tracking tables in the workspace. They should show up 5-10 min after the DCR first attempted write.
If you are looking in the correct workspace and see the FIM solution, you see the change tracking tables, and you see the VMs in the heartbeat then everything seems aligned. I would suspect the DCR rule if new changes are not being written. Has this been modified from the default?
The first 3 steps are for certain correct, FIM was enabled which created the default DCR and workspace matching the pattern you provided, extensions were added to the Arc servers as well.
I then enabled that workspace (the 'defaultWorkspace-[subscriptionId]-fim' workspace) for FIM - the workspace has the changetracking solution (in addition to the security solution)
Checking Logs while in the scope of that workspace shows only the Heartbeat and Usage tables under Tables > Log Management, no other tables appear there, although I can reference the ConfigurationChange table without error - but querying it returns nothing
The default DCR was used, unchanged, for some time - and does not seem to have returned any results. I altered it recently to watch a test file in addition to its default content, but it has not alerted to creation or changes for that file (or any other files, or registry keys)