Notification-based file integrity monitoring of a compute environment

A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for an agent deployed to a compute environment to perform a process comprising:

• identifying a file designated for file integrity monitoring within the compute environment;
• constructing a graph for data received and ingested via the agent, wherein the graph has at least data associated with file integrity monitoring operations performed by the agent;
• registering to be notified by an operating system of the compute environment when a change to the file occurs;
• performing, based on a notification received in connection with the registering, a file integrity monitoring operation, wherein the notification is included among a plurality of notifications that are received in connection with the registering and indicate different changes to the file;
• and
• the file integrity monitoring operation includes:
• determining that a first change to the file indicated by the notification occurs within a threshold amount of time to a second change to the file indicated by an additional notification of the plurality of notifications, and
• based on the determining, aggregating information about the first change and the second change within the data communicated to the data platform;
• and
• communicating, in real time to a data platform performing security monitoring of the compute environment, data associated with the file integrity monitoring operation comprising at least a portion of the graph.

A method for performing security monitoring of a compute environment, the method comprising:

• designating, by a data platform, a file within the compute environment for file integrity monitoring;
• directing, by the data platform and by way of communication with an agent deployed to the compute environment, the agent to register to be notified by an operating system of the compute environment when a change to the file occurs;
• constructing a graph for data received and ingested via the agent, wherein the graph has incorporated within it at least data associated with file integrity monitoring operations performed by the agent;
• and
• receiving, by the data platform and in real time subsequent to a file integrity monitoring operation being performed by the agent based on a notification received in connection with the agent registering to be notified, data associated with the file integrity monitoring operation, wherein the notification is included among a plurality of notifications that are received in connection with the registering and indicate different changes to the file;
• and
• the file integrity monitoring operation includes:
• determining that a first change to the file indicated by the notification occurs within a threshold amount of time to a second change to the file indicated by an additional notification of the plurality of notifications, and
• based on the determining, aggregating information about the first change and the second change within the data communicated to the data platform.