A canary file is a file that alerts via email when a file is accessed, and a percentage of the file has been read by an application. By default, canary files are not protected from writes unless specified set.
Rule name - Name of the rule
Target file folder - This is the folder that contains the file to be monitored
Target file name - The name of the file to be monitored (currently, this needs to be manually entered)
Write protect this file - If set, the file cannot be modified. If an application does attempt to modify the file, these modifications will be silently blocked.
Email address(es) - Here you can specify the email address to send the notification to. If multiple addresses are required, separate with a comma (,).
Message - The message that is to be sent along with the notification.
Advanced - Create a canary file from the terminal
The name of this alert [Canary file, monitor file access]>
The base folder, for the target file. >\My Important Files\
The target file, it must be relative to the attached rule's folder. >Important File.txt
Write protect the file [N]>n
The contact email address(es) (+ or - values to existing line, use "?" for more info) >firstname.lastname@example.org
The percentage of the file read before triggering (0 percent will report ANY read access) > The message to be displayed in the email notification >Someone is accessing my important file!
When creating a canary file from the terminal, you can also specify a percentage the file that needs to be read before an alert is sent.
Canary files vs Intrusion detection
Article is closed for comments.