Simple definition
AIDE detects unauthorized file changes by comparing filesystem metadata and hashes against a trusted integrity database.
Purpose and use
AIDE, Advanced Intrusion Detection Environment, helps identify file changes relative to a recorded baseline.
How does it work?
It compares stored attributes and hashes with the state observed during a later check.
Example and verification
Review differences after maintenance against authorized changes and system logs.
Points to watch
A baseline created on an already compromised system is not trustworthy. Protecting the baseline matters as much as protecting configuration.
In short
AIDE reports integrity differences; their cause still requires investigation.