SYSTEM INTEGRITY · Workflow idea
For a system owner authorized to monitor selected server files, compare current integrity values with a verified baseline on a chosen schedule and prepare an alert when they differ. A mismatch can reflect an approved update, a maintenance task, or an incident; it is not proof of compromise. Keep the monitored file list and alert audience narrow, protect access credentials, and have a system owner verify the change before responding.
01 / The starting point
An approved server scope, known-good reference values, and a named security contact
“Make unexpected file changes visible without treating every difference as an incident.”
02 / The work
Helps a system owner check selected remote files against known reference values and prepare a notification when a value changes.
Limit checks to files the team is authorized to monitor and assign someone to maintain the list.
Establish each baseline from a trusted, reviewed copy and record when it was confirmed.
Compare the selected files and preserve the time and result of each check.
Check maintenance, deployments, and file ownership before labeling a difference suspicious.
Have an authorized system or security owner decide whether further investigation or action is warranted.
03 / The result
A source-linked change alert with the expected and observed values for owner review.
Reviews & approvals · Example outcome
A source-linked change alert with the expected and observed values for owner review.
A changed value may be an authorized update, a mistaken baseline, or an unauthorized modification. Verify the file and maintenance history with its owner, keep alerts limited to responders, and do not make system changes based only on a mismatch.
04 / Make it yours
A few choices shape the work around your team.
Record which hosts and files may be checked and who owns the assessment.
Use least-privilege access and keep known-good values available to authorized maintainers.
Choose an appropriate check interval and notify only the responsible responders.
Distinguish planned updates from unexplained changes and require owner approval for response.