implementing-file-integrity-monitoring-with-aide

Configure AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring including baseline creation, scheduled integrity checks, change detection, and alerting

Jump to install

Repository: xalgord/xalgorix
Last source activity: June 6, 2026 at 16:41
Detected SKILL.md language: English
Stars: 813
Forks: 146

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/xalgord/xalgorix --skill implementing-file-integrity-monitoring-with-aide

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

View all from this repository

Implementing File Integrity Monitoring with AIDE

Overview

AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection system that monitors file and directory integrity using cryptographic checksums. This skill covers generating AIDE configuration files, initializing baseline databases, running integrity checks, parsing change reports, and setting up automated cron-based monitoring with alerting.

When to Use

When deploying or configuring implementing file integrity monitoring with aide capabilities in your environment

When establishing security controls aligned to compliance requirements

When building or improving security architecture for this domain

When conducting security assessments that require this implementation

Common Misconfigurations & Verification

Baseline DB stored on the host: if aide.db.gz lives at its default /var/lib/aide/aide.db.gz on the monitored system, an attacker with root simply re-runs aide --init and copies aide.db.new.gz over it, erasing evidence. Store the baseline (and aide.conf) read-only off-host or on signed/immutable media, and compare against that copy.

DB never updated after legit changes: after patching, admins run aide --update and blindly promote aide.db.new.gz to the baseline, masking any malicious change made in the same window. Diff the report before promoting, and update the DB out-of-band.

Weak rule selection: lines using p+i only (perms/inode) miss content tampering. Confirm critical paths use a hashing ruleset (e.g., Checksums = sha256+sha512) and that /etc, /bin, /sbin, /usr/bin, /boot are actually in scope and not shadowed by a later !exclude.

Check not scheduled / output unread: a cron job that writes to a local file no one reads is not monitoring. Verify the cron entry exists and routes results to a SIEM or mailbox.

Verification: touch a canary change (chmod o+w /etc/passwd or add a file under /usr/bin), run aide --check, and confirm it reports the added/changed entry with a checksum mismatch; then revert. A clean report after a known change means the rules or DB path are wrong.

Prerequisites