File Integrity Monitor Python

A beginner-friendly SOC Analyst / Blue Team project that monitors files for unauthorized changes using SHA-256 hashing.

SOC Skills Demonstrated

• File integrity monitoring
• Hashing with SHA-256
• Blue Team detection logic
• Incident response documentation
• Python scripting
• Change detection

Project Files

• file_integrity_monitor.py - Main Python script
• watch_folder/ - Folder being monitored
• baseline.json - Created automatically after first scan
• reports/integrity_report.txt - Report created after scan
• requirements.txt - Python requirements

How It Works

1. The tool scans files inside watch_folder
2. It creates a baseline hash for each file
3. On the next scan, it compares current hashes to the saved baseline
4. It alerts if a file was modified, deleted, or newly added

How to Run

Step 1: Create the baseline

python file_integrity_monitor.py --baseline

Step 2: Scan for changes

python file_integrity_monitor.py --scan

Example Alerts

ALERT: File modified: watch_folder/important_config.txt
ALERT: New file detected: watch_folder/suspicious_file.txt
ALERT: File deleted: watch_folder/password_policy.txt

Why This Project Matters

File integrity monitoring is important in cybersecurity because attackers often modify system files, scripts, web pages, or configuration files after gaining access. SOC Analysts and Blue Team defenders use integrity monitoring to detect unauthorized changes quickly.