Set up Integrity Monitoring

The Integrity Monitoring protection module detects changes to files and critical system areas like the Windows registry that could indicate suspicious activity. The module does this by comparing current conditions to a previously recorded baseline. Server & Workload Protection has predefined Integrity Monitoring rules and provides new Integrity Monitoring rules in security updates.

Integrity Monitoring detects changes made to the system, but does not prevent or undo the changes.

You can enable Integrity Monitoring in policies or at the computer level. Enabling Integrity Monitoring involves several procedures:

You can enable Integrity Monitoring in the settings for a computer or in policies.

Run a recommendation scan on the computer to get recommendations for appropriate rules. Recommended Integrity Monitoring rules may result in too many monitored entities and attributes. The best practice is to decide what is critical and should be monitored, then create custom rules or tune the predefined rules. Pay extra attention to rules that monitor frequently-changed properties such as process IDs and source port numbers because such rules can be noisy and may need some tuning.

If you enable real-time Integrity Monitoring scans and find that some recommended rules produce too many events, you can disable real-time scanning for those rules.

When you run a recommendation scan, you can have Server & Workload Protection automatically implement the recommended rules or you can manually assign rules. You can edit a rule locally, so the changes apply only to that computer or policy, or globally, so the changes apply to all policies or computers that use the rule. You can also create custom rules to monitor for specific changes that concern your organization, such as a new user being added or new software being installed. For information on how to create a custom rule, see Integrity monitoring rules language.

Some Integrity Monitoring rules require local configuration. If you assign one of these rules to your computers or one of these rules gets assigned automatically, an alert notifies you to configure the rule.

The baseline is the original secure state compared against Integrity Scan results. A best practice is to run a new baseline scan after applying patches.

To create a new baseline for Integrity Scans on a computer:

Perform an Integrity Monitoring scan using one of these methods:

Before continuing with Integrity Monitoring configuration, verify that the rules and baseline work correctly:

You can change the following settings to help improve the performance of Integrity Monitoring scans:

Integrity Monitoring uses local central processing unit (CPU) resources when creating the baseline and comparing a later state to the baseline. If you find that Integrity Monitoring is consuming more resources than you want, you can restrict the CPU usage to the following levels:

To change the Integrity Monitoring CPU Usage Level:

You can choose the hash algorithm that Integrity Monitoring uses to store baseline information. Avoid using more than one algorithm to prevent detrimental effects on performance.

Event tagging can help you sort events and determine which ones are legitimate and which need further investigation.

Manually apply tags to events by right-clicking the event and selecting Add Tag(s). You can apply the tag to only the selected event or to similar Integrity Monitoring events. You can also use auto-tagging to group and label multiple events.

You can use these sources to perform the tagging:

For more information on event tagging, see Apply tags to identify and group events.