Symantec Endpoint Protection File Integrity Monitoring ((hot)) Site

Abstract File Integrity Monitoring (FIM) is a critical security control for detecting unauthorized changes to files and system configurations. Within Symantec Endpoint Protection (SEP), FIM provides organizations with the ability to monitor critical operating system, application, and data files. This paper explores the architecture, configuration, use cases, and operational benefits of SEP’s FIM capability, along with best practices for deployment. 1. Introduction Organizations face increasing threats from ransomware, insider attacks, and advanced persistent threats (APTs). Attackers often modify system binaries, registry keys, or configuration files to maintain persistence or escalate privileges. File Integrity Monitoring addresses this by alerting security teams to both malicious and accidental changes.