Tripwire is the original file integrity monitoring (FIM) tool, available as both an open-source utility (tripwire-oss) and the commercial Tripwire Enterprise. It establishes a known-good baseline of file hashes, permissions, and metadata, then alerts on any deviation — a textbook indicator of tampering, malware persistence, or unauthorised admin changes.
CySA+ references FIM directly under both security operations and
incident response objectives because integrity violations on binaries, web roots, /etc/, or registry keys are high-fidelity compromise signals.