flowchart LR
    subgraph K["Linux Kernel Space"]
        FS["File-System Operations"]
        IN["inotify Subsystem"]
        FS --> IN
    end

    subgraph U["User-Space Monitoring Agent"]
        WM["Watch Manager"]
        EC["Event Collector"]
        EP["Event Parser and Enrichment"]
        DE["Detection Engine"]

        WM -->|"Registers watched paths"| IN
        IN -->|"File-system events"| EC
        EC --> EP
        EP --> DE
    end

    subgraph C["Context Sources"]
        PROC["/proc Process Metadata"]
        HASH["File Hashing: SHA-256"]
        USER["User and Permission Data"]
    end

    PROC --> EP
    HASH --> EP
    USER --> EP

    subgraph O["Outputs"]
        DB[("Event Database")]
        LOG["Structured Logs: JSON"]
        ALERT["Alert Manager"]
        DASH["Monitoring Dashboard"]
    end

    DE --> DB
    DE --> LOG
    DE --> ALERT
    DB --> DASH
    ALERT --> DASH

    ALERT -->|"Optional"| SIEM["SIEM: Wazuh, Elastic, or Splunk"]

Loading

Linux-FileOwl

Linux kernel subsystem that monitors file system events. It can be used to detect when files are created, modified, or deleted

   

  graph TD
      subgraph "Linux File System Hierarchy"
          Root(/) --> bin[bin: Essential command binaries]
          Root(/) --> boot[boot: System boot loader files]
          Root(/) --> dev[dev: Device files]
          Root(/) --> etc[etc: Host-specific system-wide configuration files]
          Root(/) --> home[home: User home directory]
          Root(/) --> lib[lib: Shared library modules]
          Root(/) --> media[media: Media file such as CD-ROM]
          Root(/) --> mnt[mnt: Temporary mounted filesystems]
          Root(/) --> opt[opt: Add-on application software packages]
          Root(/) --> proc[proc: Interface to kernel data structures]
          Root(/) --> root_dir[root: Home directory for root user]
          Root(/) --> run[run: Run-time program data]
          Root(/) --> sbin[sbin: System binaries]
          Root(/) --> srv[srv: Site-specific data served by this system]
          Root(/) --> sys[sys: Virtual directory providing information about the system]
          Root(/) --> tmp[tmp: Temporary files]
          Root(/) --> usr[usr: Unix System Resources]
          Root(/) --> var[var: File that is expected to continuously change]
    end

Loading

📖 Contents

• My Awesome Lists
• Contributing
• Contributors

Installation Steps

Linux File System Hierarchy

Common Inotify Event Types

Event Type	Syntax	Description
File created	IN_CREATE	A file or directory is created inside the monitored directory.
File modified	IN_MODIFY	The contents of a monitored file are modified.
Write completed	IN_CLOSE_WRITE	A file opened for writing is closed. Recommended for triggering file scanning or hashing.
Read completed	IN_CLOSE_NOWRITE	A file opened without write access is closed.
File opened	IN_OPEN	A monitored file or directory is opened.
File accessed	IN_ACCESS	A monitored file is accessed or read.
File deleted	IN_DELETE	A file or directory is deleted from the monitored directory.
Monitored object deleted	IN_DELETE_SELF	The monitored file or directory itself is deleted.
File moved out	IN_MOVED_FROM	A file or directory is moved out of the monitored directory.
File moved in	IN_MOVED_TO	A file or directory is moved into the monitored directory.
Monitored object moved	IN_MOVE_SELF	The monitored file or directory itself is moved.
Metadata changed	IN_ATTRIB	File metadata changes, such as permissions, ownership, or timestamps.
Watch removed	IN_IGNORED	The inotify watch is removed automatically or explicitly.
File system unmounted	IN_UNMOUNT	The file system containing the monitored object is unmounted.
Event queue overflow	IN_Q_OVERFLOW	The inotify event queue overflows, which means events may have been lost.
Directory indicator	IN_ISDIR	An additional flag indicating that the affected object is a directory.

My Awesome Lists

You can access the my awesome lists here

Contributing

Contributions of any kind welcome, just follow the guidelines!

Contributors

Thanks goes to these contributors!

🔼 Back to top