🛡️ PyFIM Sentinel - Advanced File Integrity Monitor

An advanced File Integrity Monitoring (FIM) tool integrated with Discord Alerts and Ransomware Heuristics to detect unauthorized file modifications in real-time.

📌 Overview

PyFIM Sentinel is a lightweight, agent-less security tool designed to monitor sensitive directories for unauthorized changes. It utilizes SHA-256 hashing to create a baseline of file integrity and continuously verifies current file states against this baseline.

It includes a Heuristic Analysis Engine that detects rapid mass-file modifications—a behavioral pattern typical of Ransomware attacks—and triggers critical alerts immediately via Discord.

✨ Key Features

• Real-Time Monitoring: Detects file creation, modification, and deletion events instantly.
• 🚨 Ransomware Detection: Heuristic algorithms identify rapid file encryption/deletion (e.g., >5 files in 10s).
• Discord Integration: Sends real-time alerts to a SOC channel via Webhooks.
• Forensic Logging: Maintains a local audit trail (fim_log.txt) with timestamps.
• Visual Console: Color-coded terminal output for easy status monitoring.

⚙️ Installation

1. Clone the Repository:

   git clone [https://github.com/YourUsername/PyFIM-Sentinel.git](https://github.com/YourUsername/PyFIM-Sentinel.git)
   cd PyFIM-Sentinel
   

2. **Install Dependencies:**
```bash
pip install -r requirements.txt

(Or simply run pip install requests)

🔧 Configuration

Before running the tool, open fim.py in any text editor and update the following:

1. Set Target Folder

Find the variable TARGET_FOLDER and paste the path of the folder you want to protect.

TARGET_FOLDER = r"D:\Projects\Critical_Data"

2. Set Discord Webhook (For Alerts)

To get alerts on your phone/PC, you need a Webhook URL:

1. Create a personal Discord Server (it's free).
2. Go to Server Settings -> Integrations -> Webhooks.
3. Click New Webhook, give it a name, and click Copy Webhook URL.
4. Paste it into the script:

WEBHOOK_URL = "[https://discord.com/api/webhooks/YOUR_KEY_HERE](https://discord.com/api/webhooks/YOUR_KEY_HERE)"

🚀 Usage

Run the script using Python:

python fim.py

Modes:

• [1] Initialize Baseline: Calculates hashes for all files in the target directory and saves them to baseline.json. Run this first or whenever you make authorized changes.
• [2] Start Monitoring: Begins the continuous monitoring loop. Keep this terminal window open to view live alerts.

📸 Screenshots

Monitoring Dashboard

Above: The tool detecting a ransomware simulation (rapid file deletion).

⚠️ Disclaimer

This tool is developed for educational and defensive purposes only. It is designed to demonstrate the principles of File Integrity Monitoring and behavioral analysis.

---

Created by Satyam Krishna