The Complete Production SOP: How to Deploy and Run AIDE Advanced File Integrity Monitoring (FIM) in Autonomous AI Agents
Step-by-step SOP to install and run AIDE Advanced File Integrity Monitoring in Codex, Claude Code, and Cursor. Audit hashes, aide.conf, and baseline DBs.
Technical Overview & Architectural Context
Autonomous coding and sysadmin agents frequently fail when tasked with security baselining because they mistake dynamic log mutations for unauthorized tampering, mismanage active versus staging database paths, or write destructive in-place modifications to /etc/aide/aide.conf. Without deterministic operational boundaries, LLMs often attempt non-existent helper scripts, omit critical SHA-256 attributes, or fail to rotate staging databases to production locations (/var/lib/aide/aide.db.new to /var/lib/aide/aide.db). The aide-advanced-intrusion-detection skill enforces strict, standardized procedural boundaries. It ensures agents construct idempotent rulesets, respect system-specific macro paths, isolate read-only targets, and validate exit codes before marking filesystem verification tasks as complete.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into your workspace.
Autonomous runtimes such as Claude Code, Cursor, and Codex parse workspace and global agent manifests (.agents/skills) to determine deterministic trigger boundaries. Mounting the SKILL.md specification instructs the runtime on the exact sequence required for AIDE database initialization, rule compilation, and delta verification.
mkdir -p .agents/skills/aide-advanced-intrusion-detection && curl -fsSL https://askills.dev/api/skills/aide-advanced-intrusion-detection/raw -o .agents/skills/aide-advanced-intrusion-detection/SKILL.md---
name: "aide-advanced-intrusion-detection"
description: "Detect unauthorized filesystem modifications and rootkits with AIDE file integrity monitoring."
metadata:
author: "AIDE Project"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "initialize aide database"
- "check file integrity aide"
- "configure aide.conf"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---Pinning explicit rules in workspace-level SKILL.md files saves over 1,200 tokens per prompt compared to repeatedly passing raw aide.conf templates in the agent conversation window.
Ensure that fs_write permissions strictly target local configs or staging outputs; never grant an agent unrestricted write privileges over /var/lib/aide without manual confirmation.
AIDE Configuration Validation & Template Generation
Configure deterministic macro rules and baseline hash rulesets within aide.conf.
Before running integrity operations, the agent must define attribute groups (e.g., FIPSR = p+i+n+u+g+s+m+c+acl+selinux+sha256) and map out monitored paths while excluding volatile log directories and ephemeral containers.
sudo mkdir -p /etc/aide /var/lib/aide /var/log/aide && sudo aide --version@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide
database_in=file:@@{DBDIR}/aide.db
database_out=file:@@{DBDIR}/aide.db.new
gzip_dbout=yes
# Baseline Rule Group: Permissions, Inodes, Hashes
SEC_RULE = p+i+n+u+g+s+m+c+sha256
# Monitored Critical Directories
/bin SEC_RULE
/sbin SEC_RULE
/usr/bin SEC_RULE
/usr/sbin SEC_RULE
/etc SEC_RULE
!/etc/mtab
!/etc/aide/aide.db.*Always use 'database_out=file:@@{DBDIR}/aide.db.new' to avoid race conditions and database corruption during baseline creation.
Failing to negate dynamic runtime files like /etc/mtab or temporary locks will cause false positive alerts on every integrity audit.
Intent Matching & Baseline Initialization Trigger
Invoke the baseline generation workflow using frontmatter trigger phrases.
Provide the agent with targeted trigger directives. When matching 'initialize aide database', the agent invokes the compiled binary to compute cryptographic digests and atomically activates the baseline database.
sudo aide --init --config /etc/aide/aide.conf && sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gzEnsure the agent runs initialization under a clean shell environment so environment variables do not skew runtime paths.
On Debian/Ubuntu systems, aideinit wraps aide --init and creates uncompressed files by default. Check file extensions (.gz vs raw) before executing rename commands.
Verification, Integrity Audit & Delta Quality Gate
Execute automated self-healing checks and delta reports to verify agent deliverables.
The agent must perform an immediate dry-run check using 'aide --check'. A clean baseline should return exit code 0 or exit code 14 (if non-critical attributes changed). The agent parses the standard output report and confirms zero unauthorized binary alterations.
sudo aide --check --config /etc/aide/aide.confAIDE uses bitmask exit codes (e.g., 4 = file attributes changed, 0 = no changes). Configure agent handlers to inspect bitmasks rather than failing strictly on non-zero returns.
Do not execute 'aide --update' automatically without validating the report diff, as this will overwrite your known-good baseline with potentially tampered binaries.
Real-World Scenario: Automated Hardening and File Integrity Verification for /usr/bin and /etc
“initialize aide database and check file integrity aide on this production runner, reporting any anomalies found in /etc or /usr/bin.”
Runtime Troubleshooting & Failure Modes
Root Cause: The baseline database has not been initialized, or the database_in parameter in aide.conf points to an uncompressed file when only a .gz file exists.
sudo aide --init && sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db || sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gzRoot Cause: Files covered by rules were modified after database initialization, or an unauthorized system package update occurred without running a baseline update.
sudo aide --check --config /etc/aide/aide.conf | tee /var/log/aide/aide_audit.log && sudo aide --update && sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gzFrequently Asked Questions (AIDE Advanced File Integrity Monitoring (FIM) SOP)
Q:Can I use AIDE Advanced File Integrity Monitoring (FIM) across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the open SKILL.md specification. When placed in ~/.agents/skills or your workspace root, any runtime supporting prompt triggers (Codex, Claude Code, Cursor, Windsurf) can parse and execute the deterministic SOP.
Q:How does AIDE Advanced File Integrity Monitoring (FIM) prevent context window overflow during long agent sessions?
The skill provides concise configuration templates and instructs the agent to write large audit outputs directly to log files (/var/log/aide/aide.log) rather than streaming thousands of line items into the interactive agent context window.
Q:Does this skill require escalated root or container permissions?
Yes, reading protected system files in /etc or /sbin and generating root-owned cryptographic databases in /var/lib/aide requires root or elevated capabilities (CAP_DAC_READ_SEARCH). However, the skill frontmatter sets shell_exec: false to require human-in-the-loop authorization before terminal execution.
Ready to equip your autonomous agent with AIDE Advanced File Integrity Monitoring (FIM)?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.