While the System Integrity Monitoring (ODFIM) task is running, each object change is determined by comparing the current state of the monitored objects with its original state, which was previously established as a baseline.
The baseline is established during the first run of the ODFIM task on the computer. You can create several ODFIM tasks. For each ODFIM task, a separate baseline is created. The task is performed only if the baseline corresponds to the monitoring scope. If the baseline does not match the monitoring scope, Kaspersky Industrial CyberSecurity for Linux Nodes generates a system integrity violation event.
The baseline is rebuilt after an ODFIM task has finished. You can rebuild a baseline for a task using the corresponding setting. Also, a baseline is rebuilt when the settings of a task change, for example, if a new monitoring scope is added. The baseline will be rebuilt during the next task run. You can delete a baseline by deleting the corresponding ODFIM task.
The ODFIM task creates storage for baselines on a computer that has the System Integrity Monitoring component installed.
System Integrity Check task settings
Setting |
Description |
|---|---|
Rebuild baseline on each task start |
This check box enables or disables the reestablishment of a system baseline upon every start of the System Integrity Check task. This check box is cleared by default. |
Use hash for monitoring (SHA-256) |
This check box enables or disables use of the SHA-256 hash for the System Integrity Check task. SHA-256 is a cryptographic hash function that produces a 256-bit hash value. The 256-bit hash value is represented as a sequence of 64 hexadecimal digits. This check box is cleared by default. |
Track directories in monitoring scopes |
This check box enables or disables the monitoring of the specified directories while the System Integrity Check task is running. This check box is cleared by default. |
Track last file access time |
This check box enables or disables tracking the file access time while the System Integrity Check task runs. This check box is cleared by default. |
Monitoring scopes |
The group of settings contains the Configure button. Clicking this button opens the Scan scopes window. |
In the Exclusion scopes section, you can also configure monitoring exclusion scopes and exclusions by mask for the System Integrity Check task.
Page top