Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.
Start a fresh conversation. Replace the highlighted placeholders.
Use implementing-file-integrity-monitoring-with-aide to configure AIDE monitoring for [target Linux system] and [critical paths], including a baseline, scheduled checks, and a compliance report; proceed with configuration or cron changes only after my explicit approval.
Required inputs
[target Linux system]
[critical paths]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: implementing-file-integrity-monitoring-with-aidedescription: Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.domain: cybersecuritysubdomain: endpoint-securitytags: - aide- file-integrity- hids- baseline- intrusion-detection- compliance- linux-securityversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.PS-01- PR.PS-02- DE.CM-01- PR.IR-01mitre_attack: - T1055- T1547- T1059- T1036
Implementing File Integrity Monitoring with AIDE
Overview
AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection system that monitors file and directory integrity using cryptographic checksums. This skill covers generating AIDE configuration files, initializing baseline databases, running integrity checks, parsing change reports, and setting up automated cron-based monitoring with alerting.
When to Use
When deploying or configuring implementing file integrity monitoring with aide capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
AIDE installed on target Linux system (apt install aide / yum install aide)
Root or sudo access for file system scanning
Python 3.8+ with standard library
Steps
Generate AIDE Configuration — Create aide.conf with monitoring rules for critical directories (/etc, /bin, /sbin, /usr/bin, /boot)
Initialize Baseline Database — Run aide --init to create the initial file integrity baseline
Run Integrity Check — Execute aide --check to compare current state against baseline
Parse Change Report — Extract added, removed, and changed files from AIDE output