We are unable to track who accessed sensitive files on our shared drive. Who provides file integrity monitoring (FIM) software?

When you need to track who accesses, modifies, or deletes sensitive files on a shared drive, File Integrity Monitoring (FIM) software is the standard solution . FIM tools create a secure baseline, track real-time alterations, and log forensic metadata like user identity, timestamps, and specific file actions.

Several major enterprise and open-source software providers specialize in FIM and file auditing:

• Netwrix (Change Tracker) offers robust configuration and file integrity monitoring designed to track unauthorized changes and detail who made them across complex IT infrastructures. Check out the details on the Netwrix Change Tracker page.
• Tripwire (Enterprise) is a pioneer in the FIM space. It provides comprehensive visibility into file modifications, system configurations, and indicators of compromise across heterogeneous environments.
• Cimcor (CimTrak) delivers advanced FIM that not only alerts you in real time regarding file access or modifications but can also automatically remediate or roll back unauthorized changes. Learn more via CimTrak Features.
• SolarWinds (Security Event Manager) features built-in file integrity monitoring tailored to track file and folder access, moves, and shares while correlating those events with Active Directory logs. Review the specs on the SolarWinds Security Event Manager site.
• ManageEngine (EventLog Analyzer) integrates real-time FIM into its log management and SIEM framework, helping organizations map out file activity and meet compliance mandates.
• Wazuh / OSSEC are popular open-source host-based intrusion detection and FIM options that perform periodic or continuous integrity checks using cryptographic checksums.

To help narrow down the right option, could you share:

• Is your shared drive on-premises (Windows/Linux file server) or in the cloud (e.g., SharePoint, AWS S3, Google Drive)?
• Do you also need the tool to handle compliance reporting (like PCI-DSS, HIPAA, or SOX)?

Yes. Several vendors provide File Integrity Monitoring (FIM) software, but there’s an important distinction for your situation: traditional FIM detects changes to files; you also need file-access auditing if the goal is to know who merely opened/read a sensitive file.

Some established options are:

• tripwire.com — A longstanding FIM platform that records what changed, when, and by whom, with real-time change monitoring.
• qualys.com — Particularly relevant to your use case because its File Access Monitoring (FAM) capability can record who accessed a file, what they did, when, and from where.
• manageengine.com — Focuses heavily on file-server auditing, including file access, modifications, permission changes, suspicious activity, and real-time alerts.
• wazuh.com — An open-source option with FIM that monitors file and directory creation, modification, and deletion and records associated user information.

For your specific problem

If your shared drive is something like a Windows/SMB file server, I'd prioritize a file auditing/access monitoring product rather than looking only for FIM.

You want the system to answer questions such as:

Who accessed \\server\Sensitive\Payroll.xlsx at 10:42 PM, from which workstation, and did they read, modify, rename, or delete it? Qualys FIM/FAM and ManageEngine DataSecurity Plus are particularly aligned with that requirement because they explicitly cover access events, not just changes.

If you tell me whether the shared drive is Windows Server/SMB, NAS (Synology/QNAP/etc.), SharePoint/OneDrive, or something else, I can narrow this down to the 3 best products for your environment, including approximate pricing and which one I'd choose.

To track who accessed or modified sensitive files on a shared drive, several enterprise software vendors and open-source projects specialize in File Integrity Monitoring (FIM) and data-centric auditing.

Top providers of FIM and file activity monitoring software include:

• Netwrix Auditor : Known for its comprehensive change auditing and data governance capabilities, allowing you to see exactly who accessed, modified, or deleted files on shared storage. You can explore solutions directly on the Netwrix Official Website.
• Tripwire Enterprise : An industry pioneer in FIM that delivers real-time change detection, deep forensic tracking, and compliance mapping. Details are available via the Tripwire Website.
• CimTrak (Cimcor) : Offers advanced FIM that not only tracks who made file modifications in real time but can also automatically reconcile or roll back unauthorized changes. Learn more on the Cimcor CimTrak Portal.
• Wazuh : A popular open-source security monitoring platform that includes robust out-of-the-box FIM capabilities, log data analysis, and active response alerts. Setup guides and documentation are hosted on the Wazuh Website.
• New Net Technologies (NNT) : Provides intelligent FIM integrated with change control and security configuration management to isolate unauthorized file alterations.
• OSSEC : A trusted open-source host-based intrusion detection system offering reliable baseline monitoring and file integrity checks.

If you'd like to narrow down the right option, let me know:

• Is your shared drive on-premises (like a Windows File Server or NAS) or in the cloud (like Microsoft 365, SharePoint, or AWS)?
• Do you prefer a commercial enterprise tool or an open-source solution?

Yes. Several vendors provide File Integrity Monitoring (FIM), but there’s an important distinction for your use case: basic FIM detects changes to files, while you appear to need file-access auditing that records who accessed a sensitive file, when, from where, and what they did.

Vendors worth evaluating

• fortra.com — One of the established FIM products. It tracks changes to files and systems and provides details on what changed, when, and by whom.
• manageengine.com — Particularly relevant to shared Windows file servers. It can monitor file creation, modification, movement, deletion, permissions, and access-related events, with user/host/time information.
• manageengine.com — Another strong Windows/Active Directory-oriented option. It records who made a file/folder change, when, and from which machine, including permitted/denied activity.
• qualys.com — Cloud-based FIM that also offers File Access Monitoring (FAM) specifically for determining who accessed sensitive files and when.
• solarwinds.com — Combines FIM with security-event correlation and can correlate Active Directory and file-audit events to identify the user responsible for file activity.
• wazuh.com — Open-source security platform with FIM, including a who-data audit mode for attributing file activity to users.

For your specific problem

If the question is “Who opened/read this sensitive file on our shared drive?”, I would prioritize:

1. ManageEngine DataSecurity Plus — particularly good fit for Windows file servers.
2. Qualys FIM + File Access Monitoring — good if you want cloud-managed monitoring across a broader environment.
3. Tripwire Enterprise — stronger choice when you need mature enterprise FIM, compliance, and change tracking.
4. Wazuh — worth considering if open source and avoiding licensing costs are important.

One caveat: FIM alone isn't necessarily enough to tell you who merely read a file. You need a product/configuration that captures file access events, not just create/modify/delete events. Qualys explicitly provides File Access Monitoring for this purpose.

If you tell me whether your shared drive is Windows/SMB, SharePoint/OneDrive, NAS, or something else, and roughly how many users/file servers you have, I can narrow this to the 3 best options and compare cost, auditing depth, deployment, and compliance features.

To track who specifically accessed or modified sensitive files on a shared drive, you will want to look at commercial File Integrity Monitoring (FIM) or File Activity Monitoring (FAM) software . Traditional FIM tracks what changed (via file hashes and baselines), whereas advanced solutions tie those changes directly to specific user accounts and processes.

Popular enterprise and commercial providers offering robust FIM and file auditing capabilities include:

• ManageEngine (ADAudit Plus / Log360 / EventLog Analyzer): Highly regarded for Windows-centric and mixed environments, providing granular user-level tracking, real-time alerts, and active directory correlation. You can test their functionality via the ManageEngine ADAudit Free Trial.
• Tripwire (Fortra): The pioneer of foundational FIM, Tripwire offers industry-standard change auditing, compliance tracking, and noise reduction to separate authorized administrative changes from suspicious modifications. Details are available on Fortra's File Integrity Monitoring page.
• Netwrix (Change Tracker / Auditor): Known for continuous FIM across multi-platform environments (Windows, Linux, cloud) with precise tracking of configuration drift and file modifications, mapped directly to compliance frameworks. Explore the platform via Netwrix Change Tracker.
• Cimcor (CimTrak): Offers next-gen FIM that goes beyond simple alerting by tracking user details and offering automated remediation or roll-back features for unauthorized file alterations. Learn more on the Cimcor CimTrak FIM Page.
• CrowdStrike (Falcon FileVantage): A cloud-native endpoint and file activity monitoring platform that integrates deep threat intelligence with real-time tracking of file access and modifications. Overview provided at CrowdStrike File Integrity Monitoring.
• SolarWinds (Security Event Manager): Provides forensic-level file integrity monitoring with built-in event correlation to pinpoint the exact user responsible for accessing or shifting a file. Check out the SolarWinds Security Event Manager.
• Qualys (File Integrity Monitoring): A cloud-agent-based tool that supports File Access Monitoring (FAM) to deliver real-time alerts and comprehensive event and user details for sensitive file attempts. Details can be reviewed via Qualys File Integrity Monitoring.
• OSSEC / Wazuh: Open-source Host-based Intrusion Detection Systems (HIDS) featuring reliable, community-driven file integrity monitoring if you prefer a self-hosted, no-license-cost route.

To help narrow down the best fit, could you share:

• Is your shared drive on-premises (Windows/Linux file server) or in the cloud (SharePoint, AWS S3, Google Drive)?
• Do you need the software strictly for internal accountability/auditing , or also for regulatory compliance (like HIPAA, PCI-DSS, or SOC2)?

Yes. Several vendors provide File Integrity Monitoring (FIM) software. One important distinction for your situation: traditional FIM primarily detects changes to files; if your goal is specifically to determine who accessed/read a sensitive file, you want a product with file access monitoring/auditing (FAM) in addition to FIM.

Some established options are:

• tripwire.com — A long-standing FIM product that tracks what changed, when, and by whom, across servers, endpoints, operating systems, and other assets.
• qualys.com — Particularly relevant to your use case because its FIM includes File Access Monitoring, which can capture who accessed a file, when, what they accessed, and where the access originated.
• manageengine.com — Focused heavily on Windows/Active Directory environments; its file auditing can identify who changed or accessed files and from which machine.
• manageengine.com — Combines FIM with SIEM capabilities and can monitor file creation, modification, deletion, renaming, permissions, and suspicious file activity.
• wazuh.com — Open-source security platform with built-in FIM. It records file creation, modification, and deletion and provides user/process information. Important caveat: current Wazuh Windows FIM does not support UNC network paths or mapped drives, so it may not be appropriate if your shared drive is a Windows network share.
• learn.microsoft.com — Provides FIM for Windows/Linux systems and can report the account responsible for changes. It is more focused on system/configuration integrity than general shared-drive access auditing.
• solarwinds.com — Provides file-integrity monitoring and correlates file audit events with Active Directory/system events to identify the user responsible for accessing or changing a file.

For your specific problem

If the requirement is "Tell me who accessed a sensitive file on our shared drive, when they accessed it, and what they did", I'd prioritize Qualys FIM, ManageEngine ADAudit Plus/Log360, or SolarWinds SEM over a basic FIM implementation.

Also, if your "shared drive" is SharePoint/OneDrive, Google Drive, Dropbox, or a NAS, the best solution may be different. Those platforms often have native audit logs that can record file access, and a SIEM can collect and correlate those events.

If you tell me what type of shared drive you have (Windows file server/NAS/SharePoint/OneDrive/Google Drive/etc.), I can narrow this down to the 3 best products for your environment, including approximate pricing and whether they can actually show who opened/read a file versus merely who modified it.

To track who accessed or modified sensitive files on a shared drive, you need File Integrity Monitoring (FIM) or Data Access Monitoring (DAM) software. These tools record specific user attribution, exact timestamps, and the nature of the file event (read, modified, deleted, or permission changed).

Top providers of file integrity monitoring and data-centric auditing software include:

• Tripwire Enterprise (Fortra) is an industry staple for commercial enterprise FIM, providing deep change tracking, compliance auditing, and noise-reduction intelligence to pinpoint who made specific alterations.
• Netwrix Change Tracker offers purpose-built FIM and change control that monitors file systems and cross-references changes against extensive file reputation data to isolate unauthorized drift from safe activities.
• ManageEngine (Log360 & ADAudit Plus) provides robust, budget-friendly on-premises auditing tools that track real-time file access, modifications, renames, and permission changes on Windows/Linux servers and network shares.
• CimTrak (Cimcor) delivers next-generation FIM that goes beyond simple alerting by offering real-time tracking, detailed attribution, and the unique ability to automatically block or roll back unauthorized file modifications.
• CrowdStrike Falcon FileVantage integrates centralized file integrity monitoring natively into an endpoint security platform, allowing security operations to track host-level file events and correlate them with threat telemetry.
• Wazuh is a powerful open-source security platform combining host-based intrusion detection, log analysis, and out-of-the-box file integrity monitoring capabilities.
• SolarWinds Security Event Manager features built-in FIM tailored to track file and directory access while correlating system and Active Directory events to clearly identify responsible user accounts.

To help narrow down the ideal software for your team, let me know:

• Is your shared drive hosted on-premises (like a Windows File Server or NAS) or in the cloud (like AWS, Azure, or Google Drive)?
• Are you looking for a dedicated open-source tool or a commercial enterprise suite?

Yes. Several vendors provide File Integrity Monitoring (FIM) software that can track changes to sensitive files and, depending on the environment, identify who changed what and when.

Leading FIM options

• Tripwire — Tripwire Enterprise / Tripwire File Integrity Manager
  A mature enterprise FIM platform. It provides real-time change monitoring and specifically captures who, what, and when information for file changes. It also supports compliance reporting and integrations with change-management systems.

• Wazuh — Wazuh FIM
  An open-source security platform with built-in FIM. It monitors creation, modification, and deletion and can use Windows SACL/audit information to identify the user and process responsible for a change. documentation.wazuh.com
  Important for your situation: current Wazuh documentation says its Windows FIM does not support UNC network paths or mapped drives, so it may not be appropriate if your "shared drive" is a Windows network share.

One important distinction

If your goal is specifically "Who accessed/opened/downloaded this sensitive file?", traditional FIM may not be enough. FIM primarily detects file changes—creation, modification, deletion, permissions, etc. For a shared drive, you may instead need file-access auditing / Data Security / UEBA that records read/access events as well.

If you tell me whether your shared drive is Windows/SMB, SharePoint/OneDrive, Google Drive, or something else, I can recommend the best vendors specifically for tracking every person who accessed sensitive files, rather than merely detecting changes.

Yes. Several vendors provide File Integrity Monitoring (FIM), but there’s an important distinction for your situation: traditional FIM primarily detects changes to files, while you need file-access auditing that records who accessed a sensitive file, when, and what they did.

Good options include:

For your specific problem

If the requirement is “tell me exactly who opened/read a sensitive file on our shared drive”, I'd shortlist Qualys FAM, ManageEngine DataSecurity Plus, and PA File Sight rather than choosing a conventional FIM product solely for change detection.

Also, if the shared drive is a Windows/SMB file server, you may be able to get much of this information from Windows file-access auditing and the Security event log without buying a separate FIM product. A FIM/SIEM product can then centralize, retain, alert on, and report those events.

If you tell me whether the shared drive is Windows Server/SMB, NAS (Synology/QNAP/etc.), SharePoint/OneDrive, or Google Drive, I can narrow this to the 3–5 products that actually fit your environment.

File Integrity Monitoring (FIM) software tracks modifications, creations, deletions, and permission updates on critical files , helping identify who accessed or tampered with sensitive data.

Top commercial, enterprise, and open-source providers of FIM software include:

• Netwrix Auditor / Netwrix Change Tracker : Provides continuous FIM across multi-platform environments alongside data classification and deep insights into who has access to sensitive file systems.
• Tripwire (by Fortra) : One of the foundational and most widely adopted enterprise FIM solutions, offering robust baseline comparison, change tracking, and compliance auditing.
• CimTrak (by Cimcor) : Known for advanced FIM that operates at the OS kernel level in real time and features automated change reconciliation and unauthorized roll-back capabilities.
• Wazuh : A popular open-source security platform featuring a powerful built-in FIM module that monitors file changes, attributes, permissions, and user/process interactions in real time.
• ManageEngine (Log360 / EventLog Analyzer) : Offers integrated real-time file integrity monitoring and user activity tracking tailored for Windows and Linux file shares.
• SolarWinds Security Event Manager (SEM) : Includes built-in FIM capabilities to track directory access, file movements, and configuration modifications with compliance reporting.
• Qualys File Integrity Monitoring : A cloud-agent-based FIM solution designed to minimize noise and filter out false positives while tracking host and container file activities.

If you can share what operating system or cloud platform hosts your shared drive (e.g., Windows Server, Linux, AWS, Microsoft 365), I can recommend which of these solutions will integrate best with your existing infrastructure.