What it does. Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-file-integrity-monitoring-with-aide, or copy the skill folder into ~/.claude/skills/implementing-file-integrity-monitoring-with-aide/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-file-integrity-monitoring-with-aide/SKILL.md

SKILL.md (verbatim)

name: implementing-file-integrity-monitoring-with-aide
description: Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.
domain: cybersecurity
subdomain: endpoint-security
tags:
- aide
- file-integrity
- hids
- baseline
- intrusion-detection
- compliance
- linux-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
mitre_attack:
- T1055
- T1547
- T1059
- T1036

Implementing File Integrity Monitoring with AIDE

Overview

AIDE (Advanced Intrusion Detection Environment) is a host-based intrusion detection system that monitors file and directory integrity using cryptographic checksums. This skill covers generating AIDE configuration files, initializing baseline databases, running integrity checks, parsing change reports, and setting up automated cron-based monitoring with alerting.

When to Use

• When deploying or configuring implementing file integrity monitoring with aide capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• AIDE installed on target Linux system (apt install aide / yum install aide)
• Root or sudo access for file system scanning
• Python 3.8+ with standard library

Steps

1. Generate AIDE Configuration — Create aide.conf with monitoring rules for critical directories (/etc, /bin, /sbin, /usr/bin, /boot)
2. Initialize Baseline Database — Run aide --init to create the initial file integrity baseline
3. Run Integrity Check — Execute aide --check to compare current state against baseline
4. Parse Change Report — Extract added, removed, and changed files from AIDE output
5. Configure Automated Monitoring — Generate cron job for scheduled integrity checks
6. Generate Compliance Report — Produce structured report of all file changes with severity classification

Expected Output

• AIDE configuration file (aide.conf)
• Baseline database creation status
• JSON report of file changes (added/removed/changed) with severity
• Cron job configuration for automated monitoring

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

AIDE File Integrity Monitoring API Reference

AIDE CLI Commands

# Initialize baseline database
aide --init --config=/etc/aide/aide.conf

# Copy new database as baseline
cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Run integrity check against baseline
aide --check --config=/etc/aide/aide.conf

# Update baseline with current state
aide --update --config=/etc/aide/aide.conf

# Compare two databases
aide --compare --config=/etc/aide/aide.conf

# Validate configuration syntax
aide --config-check --config=/etc/aide/aide.conf

Configuration File Syntax (aide.conf)

# Database locations
database_in=file:/var/lib/aide/aide.db
database_out=file:/var/lib/aide/aide.db.new

# Report output
report_url=stdout
report_url=file:/var/log/aide/aide.log

# Gzip compression
gzip_dbout=yes

# Rule definitions
# p=permissions i=inode n=links u=user g=group s=size
# b=block_count m=mtime c=ctime sha256=SHA-256 hash
NORMAL = p+i+n+u+g+s+b+m+c+sha256
PERMS = p+i+u+g
LOG = p+u+g+i

# Monitor paths
/bin NORMAL
/sbin NORMAL
/etc PERMS
/boot NORMAL

# Exclusions (prefix with !)
!/var/log/.*
!/proc
!/sys
!/tmp

Available Check Attributes

Cron Automation

# Daily integrity check at 5 AM
0 5 * * * root /usr/bin/aide --check --config=/etc/aide/aide.conf \
  | mail -s "AIDE Report" security@company.com

# Weekly baseline update
0 3 * * 0 root /usr/bin/aide --update --config=/etc/aide/aide.conf \
  && cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Installation

# Debian/Ubuntu
apt install aide

# RHEL/CentOS
yum install aide

# Initialize after install
aideinit       # Debian wrapper
aide --init    # Direct command

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.