Integrity Monitoring Rules

Integrity Monitoring Rules allow the Vulnerability ProtectionDeep Security Agents to scan for and detect changes to a computer's files, directories, and registry keys and values, as well as changes in installed software, processes, listening ports, and running services. These changes are logged as Events in the Manager and can be configured to generate Alerts like any other Events. Integrity Monitoring Rules can be assigned directly to computers or can be made part of a Policy.

Integrity Monitoring Rules specify which Entities (files, registry keys, services, etc) to monitor for changes. Vulnerability ProtectionDeep Security scans all the Entities specified by the rules assigned to a computer and creates a baseline against which to compare future scans of the computer. If future scans do not match the baseline, the Vulnerability ProtectionDeep Security Manager will log an Integrity Monitoring Event and trigger an Alert (if so configured).

Integrity Monitoring Rule icons:

From the main page you can:

Integrity Monitoring Rules that are assigned to one or more computers or that are part of a Policy cannot be deleted.

Clicking New () or Properties () displays the Integrity Monitoring Rules Properties window.

Integrity Monitoring Rule Properties

General Information

The name and description of the Integrity Monitoring Rule, and -- if the rule is issued by Trend Micro -- the minimum versions of the Agent and the Vulnerability ProtectionDeep Security Manager that are required for the Rule to function.

Details

Setting the severity of a rule has no effect on how the rule is implemented or applied. Severity levels can be useful as sorting criteria when viewing a list of Integrity Monitoring Rules. More importantly, each severity level is associated with a severity value; this value is multiplied by a computer's Asset Value to determine the Ranking of an Event. (See Administration > System Settings > Ranking.)

Identification

Date when the rule was first issued and when it was last updated, as well as a unique identifier for the rule.

Content

The Content tab only appears for Integrity Monitoring Rules that you create yourself. Integrity Monitoring Rules issued by Trend Micro have a Configuration tab instead that displays the Integrity Monitoring Rule's configuration options (if any). Integrity Monitoring Rules issued by Trend Micro are not editable (although you can duplicate them and then edit the copy.)

You have the choice between three templates for creating new Integrity Rules: the Registry Value template, the File template, or the Custom (XML) template. Use the Registry Value template for creating Integrity Monitoring Rules that monitor changes to registry values. Use the File template for creating simple Integrity Monitoring Rules that monitor changes to files only. Use the Custom (XML) template to write rules in XML for monitoring directories, registry values, registry keys, services, processes, installed software, ports, (and files).

This section of the help describes the use of the Registry Value and File templates. For information on writing Integrity Monitoring Rules in XML using the Custom (XML) template, see Integrity Monitoring Rule Language in the Reference section.

Registry Value Template

Base Key

Select the base key to monitor and whether or not to monitor contents of sub keys.

Value Names

List value names to be included or excluded. Use "?" and "*" as wildcard characters.

Attributes

Use "Standard" to monitor changes in size or content. For other attributes, see RegistryValueSet in the Reference section under Integrity Rules Language.

File Template

Base Directory

Specifies the base directory for the rule. Everything else about the rule will be relative to this directory. Select "Include Sub Directories" to include sub directories. For example, a valid entry would be C:\Program Files\MySQL and selecting "Include Sub Directories".

File Names

Use the File Names fields to include or exclude specific files. Use wildcards (" ? " for a single character and " * " for zero or more characters).

These fields can be left blank to monitor all files in the base directory, but this can be very demanding on system resources if there are many and/or large files in the directory.
Attributes

The following file attributes can be monitored for change:

You can use the shorthand keyword "STANDARD", which will look for changes to:

Options

Assigned To

Displays a list of Policies which include this Integrity Monitoring Rule as well as any computers to which this Integrity Monitoring Rule has been assigned directly. Integrity Monitoring Rules can be assigned to Policies in the Policies page and to computers in the Computers page.