shared - background - neublue-pattern-01

EMBEDDED SECURITY

Appliance Integrity Monitoring

Detect signs of compromise. Understand what happened. Maintain trust in your appliance.

What is Appliance Integrity Monitoring (AIM)?

AIM is a solution that monitors runtime behavior inside Linux-based appliances to detect signs of compromise and explain the activity around them. Built for appliance manufacturers to embed in their products, it uses kernel-level visibility, contextual detections, and process lineage to separate expected appliance activity from behavior that warrants investigation, so you can see what happened, how it happened, and what may have been affected.

Know when an attacker is operating inside your appliance

AIM surfaces the behavior and the context around it at the Linux kernel level, not a trail of log lines to correlate. Sophos built it from lessons learned across five years of state-sponsored attacks on its own firewalls.

Sees what logs cannot

eBPF instruments the kernel directly, so activity is captured as it happens. Nothing depends on logs an attacker can edit or delete.

Tells routine from suspicious

Most monitoring reports that something changed. AIM weighs what happened around it, so an alert separates normal appliance behavior from activity worth investigating.

One build across kernel versions

A single sensor build runs across kernel versions with BTF, so integration does not fork with every release. It holds to CPU and memory limits you set.

Fits the product you already have

You choose which Sophos detection strategies to enable, and alerts arrive over the transport you already use.

When an appliance is compromised in the field, the first sign of it should be your own alert, not a customer escalation.

The problem: Compromise rarely looks like compromise

Attackers inside an appliance can use legitimate tools and expected processes. A file change looks benign. A log entry looks routine. In isolation, neither tells you what it means.

WHERE TRADITIONAL APPROACHES STOP

Approach	What it does	Where it falls short
File integrity monitoring	Detects changes to critical files and configurations.	Tells you what changed, not whether it indicates compromise.
Logs and audit data	Tracks authentication, execution, and configuration activity.	Isolated signals, correlated by hand, after the fact.
Custom tooling	Runs scripts written for conditions specific to your appliance.	Costly to build and maintain, with limited context across activity.

HOW AIM WORKS

From kernel event to alert,
without leaving the appliance

Instrument the kernel

The Sophos Linux Sensor uses eBPF to observe kernel activity where compromise shows up: process execution, file and mount operations, network connections, and kernel module loads. Events stream out as structured telemetry the moment they happen, with no dependence on logs an attacker can edit or delete.

Appliance Integrity Monitoring - How AIM works - Number 2

Evaluate against detections you control

Sophos provides detections built around suspicious appliance activity. A Sophos Appliance Integrity Expert then helps tune them to how your product legitimately runs, so approved maintenance and update workflows stay quiet while activity worth investigating stands out.

Appliance Integrity Monitoring - How AIM works - number 3

Assemble the whole picture

When suspicious activity is detected, AIM provides the context around it: process lineage, files and paths touched, timing, and MITRE ATT&CK tagging. Related detections can be combined, so your team investigates the sequence of behavior instead of reconstructing it from logs, FIM alerts, and scripts.

The Appliance Integrity Monitoring Flow

Sensing, evaluation and assembly all run on the appliance. What crosses the boundary is the alert and the context around it, over whichever transport you already use, and alert data stays under your control.

AIM workflow showing telemetry collection, threat detection, context enrichment, and alert generation.

What it detects

Filesystem and storage

Update-binary tampering
Log-directory tampering
Permission and attribute changes
Execution of newly created files

Process and execution

Reverse shell
Interactive shell
Database export
Network scanning

System integrity

Kernel module loads
Runtime library manipulation
Credential and capability changes
Container escape

A sample of AIM detections, built from real-world attacks on network and edge appliances.

Deployment realities

What your engineering team will ask

“Who maintains the detections?”

Sophos maintains the detection content, informed by live investigations and appliance-security research. You control which updates are evaluated and shipped through your normal release process.

“What happens at peak load?”

Monitoring can scale back when the appliance crosses load thresholds you define, so uptime-critical systems stay stable under pressure.

“How much integration work?”

Deployment is configuration-driven. Monitoring scope and detection parameters are tailored to your product, minimizing the need for custom engineering.

“What gets enabled?”

You choose which AIM detections apply to your product. Start with Sophos-provided detections and enable what matters for your appliance, rather than tuning down a generic baseline.

Explore whether AIM fits your appliance

Add appliance integrity to your product without adding it to your roadmap. The detection model is already built and ready to integrate.

Prefer email? [email protected]