FIM in defender not showing file changes for newly created file after 3 days also.

Disha Bodade 65

Team,

I have enabled FIM on one of the Resource Group it has created one default Log Analytics Workspace, DCR rule. We executed a script that will create test file on all VM's in /etc and C:\windows\system32 directory.

But those changes are not yet reflected in Defender->workload protection->FIM.

Also I don't see events generated in ConfigurationChange table in log Analytics workspace.

Not sure what could the issue.

I have enabled those directory monitoring in FIM settings as well.

Thanks,

Disha

VarunTha 4,040 Reputation points Microsoft Vendor

2024-04-30T07:08:44.8666667+00:00

Hi Disha Bodade,

Thank you for reaching out to us on Microsoft Q&A forum.

Can you please specify the Learn Path/Module that you are going through?
Disha Bodade 65 Reputation points

2024-04-30T07:23:00.2966667+00:00

Are you asking it because I have added tag as training? I didn't refer to any training module yet but I have done similar steps mentioned here

https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-enable-log-analytics?source=recommendations

Thanks,

Disha
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

FIM in defender not showing file changes for newly created file after 3 days also.