Sounds like you want Tripwire https://www.redhat.com/en/blog/security-monitoring-tripwire