Azure App Service如何实现文件完整性监控(FIM)？合规需求问询

Great question—this is a common pain point with Azure App Service since the underlying OS is abstracted away, making traditional agent-based FIM tools impossible to use, and Azure Security Center's built-in FIM only supports VMs. Luckily, there are several workarounds to implement file integrity monitoring tailored to App Service's environment:

1. Custom Script-Based Monitoring with Kudu & WebJobs #

Since you can access the App Service's file system via the Kudu console or API, you can build a custom FIM solution using scripts and scheduled tasks:

• Step 1: Establish a baseline
  Run a script (PowerShell or Bash) to generate SHA256 hashes for all critical files (e.g., web.config, binaries, core code files) and store this baseline in a secure location like Azure Blob Storage or App Service configuration settings. Example PowerShell snippet:

  $targetDir = "D:\home\site\wwwroot"
  $baseline = Get-ChildItem -Path $targetDir -Recurse -File | ForEach-Object {
      [PSCustomObject]@{
          FilePath = $_.FullName.Replace($env:HOME, "~") # Normalize path for portability
          SHA256Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
          LastModified = $_.LastWriteTimeUtc
      }
  }
  # Save baseline to Azure Blob Storage (use Az module or REST API)
  $baseline | ConvertTo-Json | Set-AzStorageBlobContent -Container "fim-baselines" -Blob "app-service-baseline.json" -Context $storageContext
  

• Step 2: Schedule regular scans
  Deploy a WebJob or use an Azure Function triggered on a schedule (e.g., every hour) to re-scan the files, compare their hashes against the baseline, and trigger alerts if discrepancies are found. You can send alerts via Azure Monitor, Microsoft Teams, or email.
• Pros: No extra agents required, full control over monitoring scope.
• Cons: Requires script maintenance, and you’ll need to handle baseline updates for legitimate deployments.

2. Azure Monitor Custom Logs & Anomaly Detection #

Integrate file integrity checks into Azure’s native monitoring ecosystem:

• Collect file metadata (hashes, modification times) via custom scripts running in your App Service or a dedicated Function, then send this data to Azure Monitor using the Data Collector API.
• Create a Log Analytics query to compare current file hashes against historical baselines. For example:

  AppServiceFIMLogs
  | where TimeGenerated > ago(24h)
  | summarize LatestHash = arg_max(TimeGenerated, SHA256Hash) by FilePath
  | join kind=inner (AppServiceFIMBaselineLogs) on FilePath
  | where LatestHash != BaselineHash
  | project FilePath, LatestHash, BaselineHash, TimeGenerated
  

• Set up an Azure Monitor Alert Rule based on this query to notify you of unexpected changes.
• Pros: Leverages Azure’s scalable monitoring infrastructure, integrates with other security alerts.
• Cons: Requires building the data ingestion pipeline, and log storage costs may apply at scale.

3. Deployment & Access Control as Indirect FIM #

Since most file changes in App Service come from deployments, you can enforce integrity by controlling and auditing change sources:

• Restrict direct file access: Disable FTP/SFTP access and limit Kudu console access to authorized users only via Azure AD role-based access control (RBAC).
• Audit deployments: Enable Deployment Slots and use Azure Activity Logs to track all slot swaps and deployment operations. Ensure all changes go through your CI/CD pipeline, and validate that deployed artifacts match the version controlled in your Git repo (e.g., compare hashes during deployment).
• Use Azure Policy: Create policies to block unauthorized modifications to App Service settings or file systems.
• Pros: Shifts left to prevent unauthorized changes instead of just detecting them.
• Cons: Doesn’t monitor runtime-generated files (e.g., logs, cache) and relies on strict deployment governance.

4. Azure Defender for App Service #

While Azure Defender for App Service doesn’t offer dedicated FIM, it provides enhanced threat detection that covers many file integrity-related scenarios:

• It automatically monitors for suspicious activities like unauthorized file uploads, modifications to critical configuration files (e.g., web.config), or execution of unusual scripts.
• Alerts are generated in Azure Security Center, which you can integrate with your SIEM system (e.g., Azure Sentinel) for centralized monitoring.
• Pros: Zero code required, native Azure integration.
• Cons: Less granular than custom FIM solutions—won’t detect all file changes, only those flagged as suspicious.

Final Recommendation #

If you need strict compliance-aligned FIM, combine Custom Script-Based Monitoring (Option 1) with Azure Monitor Alerts (Option 2) for full visibility. For lighter requirements, Azure Defender (Option 4) plus deployment governance (Option 3) should suffice.

内容的提问来源于stack exchange，提问作者Sakaldeep Yadav