File Integrity Rules defines what file changes UEC should collect and raise as File Integrity alerts. Rules are separate from application-control policy: FIM observes integrity, while WDAC controls execution.

Rule design

• Start with business-critical configuration, not every writable path.
• Prefer exact directories and file patterns.
• Exclude high-churn caches and application temp directories.
• Record why a path matters.
• Route File Integrity alerts to the team that owns the system.
• Review noisy rules instead of training analysts to ignore them.

A change event proves that bytes or metadata changed; it does not by itself identify the actor or declare the change malicious. Open the event and process context before responding.