🛡️ File Integrity Monitor (FIM) — v2

A lightweight, zero-dependency File Integrity Monitoring tool written in pure Python. It helps system administrators and security professionals detect unauthorized changes to files and directories by comparing current filesystem states against trusted baselines.

---

✨ Features

• 📸 Baseline Snapshots — Capture and store the complete state of any directory tree as structured JSON.
• 🔍 Integrity Checking — Detect new, deleted, and modified files by comparing live state against baselines.
• ⚡ Priority-Based Reporting — Changes are classified as High, Medium, or Low severity for efficient triage.
• 🔐 Optional SHA-256 Hashing — Enable cryptographic content verification for maximum integrity assurance.
• 🚀 Zero Dependencies — Uses only Python standard library modules — no pip install required.
• 📝 Dual Report Formats — Machine-readable JSON and human-readable text reports.
• 🧹 Smart Exclusions — Automatically skips virtual filesystems (/proc, /sys, /dev, /run) when scanning from root.

---

📁 Project Structure

File-Integrity-Monitor/
├── main.py              # Interactive CLI menu — entry point
├── baseline.py          # Baseline creation engine
├── check.py             # Snapshot capture & comparison logic
├── report.py            # Text report generator (priority-sorted)
├── Baselines/           # Stored baseline JSON files (auto-created)
├── Reports/             # Generated reports — JSON & text (auto-created)
├── USAGE.md             # Detailed usage guide (English)
├── CONTRIBUTING.md      # Contribution guidelines
├── requirements.txt     # Python dependencies (none required)
├── LICENSE              # MIT License
└── .gitignore           # Git ignore rules

---

🚀 Quick Start

1. Clone the Repository

git clone https://github.com/EsmailAlansi/File_Integrity_Monitor.git
cd File-Integrity-Monitor

2. Run the Tool

python3 main.py

3. Follow the Interactive Menu

==============================================
  File Integrity Monitor (Python) — v2
==============================================

[1] Create Baseline JSON
[2] Run Check and Generate Intermediate Report
[3] Generate Final Text Report
[q] Quit

📖 For detailed step-by-step instructions, see USAGE.md.

---

🔧 How It Works

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│  1. Create       │     │  2. Run Check    │     │  3. Generate     │
│     Baseline     │────▶│     & Compare    │────▶│     Report       │
│                  │     │                  │     │                  │
│  Scans target    │     │  Takes a live    │     │  Converts JSON   │
│  directory and   │     │  snapshot and    │     │  results into a  │
│  saves metadata  │     │  diffs against   │     │  human-readable  │
│  as JSON.        │     │  the baseline.   │     │  text report.    │
└─────────────────┘     └─────────────────┘     └─────────────────┘

Metadata Captured per File

Field	Description
path	Absolute file path
type	File type (file, dir, symlink, etc.)
inode	Inode number
mode	Permission bits (octal)
nlink	Hard link count
user	Owner username
group	Group name
size	File size in bytes
mtime	Last modification timestamp
symlink_target	Symlink destination (if applicable)
sha256	SHA-256 hash (optional)

Severity Classification

Level	Trigger Fields	Action
🔴 High	type, inode, mode, user, group, sha256	Investigate immediately
🟡 Medium	nlink, size, mtime, symlink_target	Review recommended
🟢 Low	Other fields	Informational

---

⚙️ Configuration

Enable SHA-256 Hashing

# Linux / macOS
export ENABLE_HASH=1
python3 main.py

# Windows (PowerShell)
$env:ENABLE_HASH = "1"
python main.py

⚠️ Note: SHA-256 hashing increases scan time significantly for large directories.

---

📋 Requirements

• Python 3.8+
• No external packages — stdlib only
• POSIX system (Linux/macOS) for full functionality (pwd, grp modules)

---

🤝 Contributing

Contributions are welcome! Please read CONTRIBUTING.md for guidelines.

---

📄 License

This project is licensed under the MIT License — see the LICENSE file for details.

---

👤 Author

Esmail AL-ansi

• GitHub: @EsmailAlansi

---

_{Built with ❤️ for cybersecurity and system administration}