# File Integrity hits not being detected

**URL:** <https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217>\
**Category:** Support\
**Created:** [March 25, 2025, 6:20pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217 "2025-03-25T18:20:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nevdev](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/nevdev/32/110_2.png) [@nevdev](https://community.limacharlie.com/u/nevdev)\
**Post date:** [March 25, 2025, 6:20pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/1 "2025-03-25T18:20:10Z")

</div>

I have enable FIM\_HIT event collection and have the necessary addon enabled for my organisation, still the FIM\_HIT event doesnt show upon the timeline. This is my FIM rule. Any guidance is appreciated

 ![image](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/847da33fcd6789f3fff9bd885f2f104c9a9cd4c2.png)

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [March 25, 2025, 6:27pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/2 "2025-03-25T18:27:12Z")

</div>

The FIM config can take about 10 minutes to sync down to the sensor. Can you confirm you waited enough time? If so, the other thing to do would be to issue a history\_dump command to the sensor after you’ve modified the file, this will send all the FILE\_\* events to the cloud so you can take a look to confirm the FILE\_ event modifying the file is there. This is a good first step because the FIM engine uses those events to generate the FIM hits.

---

<div class="post-metadata">

**Author:** ![nevdev](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/nevdev/32/110_2.png) [@nevdev](https://community.limacharlie.com/u/nevdev)\
**Post date:** [March 25, 2025, 6:34pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/3 "2025-03-25T18:34:50Z")

</div>

I am new to lima Charlie and i did wait for few minutes. How do you issue history dump command through console in Lima, I am bit confused about the format. Initially I did get an fimhit. I started facing issues after i updated the windows where the FIM\_HIT were no longer on the timeline

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [March 25, 2025, 6:39pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/4 "2025-03-25T18:39:32Z")

</div>

This is the command: [Reference: Endpoint Agent Commands](https://docs.limacharlie.io/v2/docs/reference-endpoint-agent-commands#historydump)  
You can issue it by going to your Orgs → Sensors → → Left Menu: Console.  
Will look like:

 ![image](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/2bb783c90d52d8d5b0d9b4ff1558e94f9d82738d.png)

---

<div class="post-metadata">

**Author:** ![nevdev](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/nevdev/32/110_2.png) [@nevdev](https://community.limacharlie.com/u/nevdev)\
**Post date:** [March 25, 2025, 6:43pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/5 "2025-03-25T18:43:03Z")

</div>

![image](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/8d22e87d5ef6317340a6fa9c8a15e2ab8862405c.png)  
I got an error

---

<div class="post-metadata">

**Author:** ![nevdev](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/nevdev/32/110_2.png) [@nevdev](https://community.limacharlie.com/u/nevdev)\
**Post date:** [March 27, 2025, 5:59pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/6 "2025-03-27T17:59:09Z")

</div>

@maximelb  
Any help in this, because all other events are being detected but not the FIM\_HIT ones. I forgot to mention this, I actually did get a FIM\_HIT once before i updated the windows. After updating, i encountered an issue in sign in where two accounts with same name was displayed. Ever since i got this, FIM HIT stopped tripping, even after i resolved the above issue, FIM\_HIT stopped appearing in senor’s timeline. All the other events are displayed properly

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/b2e9829e8e4281f2e5d87b4c4d424583144efe20.svg) [@system](https://community.limacharlie.com/u/system)\
**Post date:** [April 3, 2025, 5:59pm UTC](https://community.limacharlie.com/t/file-integrity-hits-not-being-detected/217/7 "2025-04-03T17:59:46Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.
