AIDE (Advanced Intrusion Detection Environment) turns your Artica appliance into a file-integrity monitor (FIM).
It takes a cryptographic baseline of the files and directories that matter — system binaries, account files, SSH keys, service configuration — and, on every scheduled run, compares the live filesystem against that baseline.
Any file that was added, removed or modified becomes a reviewable event that a security team can approve or flag.
Unlike a stand-alone aide install, Artica manages the full lifecycle for you:
The binary, the configuration, the scan schedule, the baseline, an operator triage workflow, and structured forwarding to your SIEM.
No shell, no cron editing.
¶ Why use it — advantages
- Tamper detection.
Catch unauthorized changes to binaries,/etc/passwd,/etc/shadow, SSH keys and service configs — the first thing an attacker touches after a breach.
- Compliance.
File-integrity monitoring is a mandatory control in PCI-DSS (req. 11.5), CIS Benchmarks, HIPAA, ISO 27001 and many national security baselines.
AIDE provides the evidence trail.
- Zero setup.
The AIDE binary is shipped with the appliance (noapt), the configuration is generated from editable rule groups, and the schedule is a click away.
- Reviewable, not noisy.
Every change is a triaged event (new → approved / suspect → resolved).
A guided baseline gate refuses to absorb changes into the trusted state until an operator has signed off on each one.
- SIEM-native.
Events are emitted as structuredkey=valuesyslog lines (tagartica-aide) to your local syslog, or straight to a remote SIEM (Wazuh, Splunk, ELK, QRadar…) over UDP/TCP
with a severity floor to control the volume.
- SOC-friendly workflow.
Separation of duties, audit log, and per-change escalation are built in.
¶ The sections
The feature is organized as a set of tabs. Each has its own guide:
- Dashboard
status at a glance, run now, enable and schedule.
- Events
The SOC triage queue of detected changes.
- Global rules
The built-in best-practice watch groups.
- Custom rules
Your own paths to watch or exclude.
- Baseline
Rebuild or update the trusted reference.
- Check runs
The history of integrity scans.
- Log
The audit trail of operator actions.
- SIEM / Syslog
Forward events to your SIEM.
¶ How it works in one paragraph
You enable the feature; Artica installs AIDE, seeds best-practice rule groups, generates configuration and builds the initial baseline.
A schdule entry then runs the check on your schedule.
Each detected change is upserted as an event and emitted to syslog/SIEM.
Your team triages events (approve or flag suspect). Once every change is approved, you may update the baseline to promote the current state to the new trusted reference.
That gate is the core safety property: the baseline never silently absorbs an unreviewed change.