Application integrity verification

A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations of software application integrity verification and remediation, the operations comprising:

• performing an out-of-band scan of the network appliance to identify installed program files at the network appliance, wherein the out-of-band scan is performed without interfering with normal operation of applications on the network appliance and while the applications are running on the network appliance, the installed program files correspond to the applications, and the installed program files are associated with a vendor-supplied software application under analysis that is deployed at the network appliance;
• computing a hash value of a first installed program file of the installed program files, wherein the computed hash value is a representation of content of the first installed program file;
• determining whether the first installed program file exists in vendor program files of the vendor-supplied software application under analysis, the vendor program files being maintained separate from the installed program files;
• responsive to a determination that the first installed program file exists in the vendor program files:
• fetching a hash value of a first vendor program file of the vendor program files, wherein the first vendor program file corresponds to the first installed program file, and the fetched hash value is a representation of content of the first vendor program file;
• determining whether the fetched hash value matches the computed hash value, wherein a difference between the fetched hash value and the computed hash value is an indication of an unauthorized modification to the first installed program file;
• and
• responsive to the fetched hash value differing from the computed hash value:
• classifying the first installed program file as a compromised file;
• and
• remediating the compromised file at the network appliance, wherein the remediating the compromised file includes:
• performing a factory reset of the vendor-supplied software application under analysis;
• generating an artifact of the first installed program file;
• adding the artifact of the first installed program file to an archive;
• and
• encrypting the archive to prevent further access to the first installed program file to preserve the first installed program file such that a difference in content of the first installed program file relative to the first vendor program file is able to be analyzed.