topic fschange Alternatives in Getting Data In

fschange Alternatives

dgavic — Wed, 11 Dec 2013 18:54:25 GMT

Does anyone know of another way to monitor folders/files in Windows other than fschange? I have played with the "monitor" stanza and WMI with very limited success. I have recently upgraded our infrastructure to Splunk 6, and with fschange being deprecated, I need to find an alternative to monitor file integrity.

Thank you in advance.

Re: fschange Alternatives

dart — Mon, 16 Dec 2013 13:28:34 GMT

You could either use Window's built in auditing features or you could wrap Tim Golden's change monitoring python scripts into a modular input or scripted input.

Does this help you?

Re: fschange Alternatives

dgavic — Tue, 17 Dec 2013 16:38:23 GMT

Hi dart,

Thank you for the response, but the Tim Golden's python script would not work for us. We need to monitor 6000+ endpoints in the field and installing python on each endpoint isn't an option. The other link you sent me was for fschange, and I am looking for alternatives to fschange, as fschange has been deprocated in Splunk 5.0.

Re: fschange Alternatives

AdamRosen — Thu, 12 Jan 2017 14:47:04 GMT

STEALTHbits offers a file activity monitor and preconfigured Splunk dashboard https://splunkbase.splunk.com/app/3432/