topic Re: who had access to a specific directory? in Getting Data In

who had access to a specific directory?

AlessandroMagno — Wed, 27 Mar 2013 14:22:07 GMT

Hi,

I should known, with Splunk, who had access to a specific directory in our fileserver.

Questions:
- what should be the query?
- before those query should I able the audit control in those specific folder directory?

Thanks,
AM

Re: who had access to a specific directory?

krugger — Wed, 27 Mar 2013 17:27:29 GMT

What kind of file server are we talking about?
Windows, Linux or something else? It has to be in the logs for splunk to pick it up, so you need to have an audit somewhere.

Re: who had access to a specific directory?

AlessandroMagno — Thu, 28 Mar 2013 13:33:15 GMT

Hi krugger,

our fileserver is Windows 2003.
Audit are actived, maybe I should check the Splunk Forwarder into our fileserver.

Thanks!

Re: who had access to a specific directory?

bmacias84 — Thu, 28 Mar 2013 16:51:58 GMT

Are trying to get ACLs for each folder on our file server or do you want to track changes to specific folder? I am assuming this is windows server or workstation.

Re: who had access to a specific directory?

BobM — Thu, 28 Mar 2013 16:58:51 GMT

In windows, you need to turn object auditing for the folder you are monitoring. Windows will then log events in the windows security log. Assuming you are splunking this, you can start searching for events.