If we have a file that needs to change on a device that is monitoring with a tool like Qualys File Integrity monitoring. Either on Windows or using
auditd on linux, how do we temporarily put some sort of "force field" around files or in some other way convince FIM that the changes were legitimate?
Patching and routine changes against tangentially related devices are spamming our queue with all sorts of invalid alerts. Patching occurs during maintenance windows and if FIM scanning took place during the maintenance windows it would be OK. Also, sometimes you don't want to squash alerts for an entire device just to prevent one known alert (this might be a bigger question, but I only mean it with respect to file integrity monitoring) - it's a bigger security risk and annoyance to stop alerts on a device than it is to intentionally generate alerts (think routine changes like editing /etc/hosts file or postfix relay db - these are not necessarily risky to the point that they need a freeze on ALL alerting for a device, just particular alerts).
So what I want to know is, how do security engineers usually allow changes to be made to filesystems occasionally, while not allowing arbitrary exceptions to be abused and still pick up illegitimate changes?