{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","img"]},"type":"markdown"},"seo":{"title":"Monitor File Integrity","description":"Coro's support and product documentation portal","siteUrl":"https://docs.coro.net","keywords":"Coro docs portal, documentation, support, docs","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"monitor-file-integrity","__idx":0},"children":["Monitor File Integrity"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This feature requires:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Endpoint devices running Coro Agent v3.8.7."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An active workspace subscription to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Endpoint Security"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["EDR"]}," modules."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro can monitor specified files for changes based on the baseline measured SHA-256 hash value at the first observed event, and alert admin users via a ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/console/ticket-logic-edr#file-integrity-violation"},"children":["File Integrity Violation"]}," ticket when, at subsequent checks, the hash value no longer matches."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If a file change is planned or expected, Admin users can reset the baseline hash value through the raised violation ticket. Admin users can also instruct Coro to ignore further violations for the monitored file in the same way."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In this release, the only available policy action is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review"]},". Coro will monitor files and raise tickets for violations only."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"creating-a-new-monitor-file-integrity-policy","__idx":1},"children":["Creating a new Monitor File Integrity policy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To create a new ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitor File Integrity"]}," policy:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Device Policy"]},", select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ ADD POLICY"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/endpoint-device-policies-add.0f2613fb70f25978f6b4aa4b4e80d807eed5d828c7c1e3117a6a889f4678ff26.dd802eb3.png","alt":"Add new device policy","withLightbox":true},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro displays the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add policy"]}," dialog:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/endpoint-device-policies-mfi.1db8d7841526fb0b982cbb8789676d378ffdcac4f38b451226c2b808e4c0721f.dd802eb3.png","alt":"Add new Monitor File Integrity device policy","withLightbox":true,"width":"600px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitor file integrity"]}," from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy type"]}," dropdown."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select the device ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Operating system"]}," for this policy:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Windows"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["macOS"]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Verification interval"]},":"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/endpoint-device-policies-mfi-interval.dd0087f4b95991cc8d5729e5a52d2918bfa34177f353f395577a50accf7337d6.dd802eb3.png","alt":"Set the monitoring interval for this policy","withLightbox":true,"width":"600px"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select the number of hours, days, or weeks at which Coro should recheck the integrity of the monitored files under this policy."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter the full absolute path on target devices of the file to be monitored under this policy:"]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/endpoint-device-policies-mfi-paths.00ddcf45c5ea4ee6863b7f0299546cd36b4a24ba0933dfdf92d376701e90e5d7.dd802eb3.png","alt":"Add a full file path to monitor","withLightbox":true,"width":"600px"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["+ Add path"]}," to enter an additional file path, up to a maximum of five. Use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["bin"]}," icon to remove a file."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter label names (predefined or custom) to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Labels"]}," field listed under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Applied to devices"]}," to apply the new policy to specific groups of devices."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/endpoint-device-policies-mfi-labels.9e352bdd2c99b8eeb66d45da4a7ec5d3506642489de44b4770ea76192c1c89b2.dd802eb3.png","alt":"Apply device policy to labels","withLightbox":true,"width":"600px"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["APPLY"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Coro creates the policy with the configured settings. File monitoring begins and a hash for each named file is calculated and recorded as the starting baseline."]}]}]}]},"headings":[{"value":"Monitor File Integrity","id":"monitor-file-integrity","depth":1},{"value":"Creating a new Monitor File Integrity policy","id":"creating-a-new-monitor-file-integrity-policy","depth":2}],"frontmatter":{"seo":{"title":"Monitor File Integrity"}},"lastModified":"2026-10-12T16:03:50.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/endpointsecurity/policies-fileintegrity","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}