Includes Real-Time File Integrity Monitoring (RT-FIM) as part of its intrusion detection policies. It identifies changes to files and registry entries in real-time, including details on the user who made the change.
# Example: Audit a folder for all changes auditpol /set /subcategory:"File System" /success:enable /failure:enable The FIM/HIPS features are typically not included in
Does Symantec Endpoint Protection Have File Integrity Monitoring? For organizations looking for "checkbox" compliance FIM, SEP
The FIM/HIPS features are typically not included in the base "Endpoint Protection" license. They often require the tier or the legacy SEP Advanced Threat Protection license. Organizations buying the basic antivirus tier may find the feature greyed out. forensic-level file change tracking
For organizations looking for "checkbox" compliance FIM, SEP is sufficient. For organizations looking for deep, forensic-level file change tracking, SEP may feel limited compared to dedicated FIM solutions like Tripwire or OSSEC.