Glossary
AIDE (file integrity)
A host-based intrusion detection tool that monitors files for unauthorized changes by comparing them against a trusted baseline database.
AIDE (Advanced Intrusion Detection Environment) is a file integrity checker. It records a baseline of cryptographic hashes and attributes for chosen files and directories, then later re-scans and reports anything that was added, removed, or modified. This reveals tampering with system binaries or configuration that an attacker may have made.
The baseline is built with aide --init and checks run with aide --check, driven by /etc/aide/aide.conf. The database should be stored on read-only or off-host media so it cannot be quietly altered.