topic Re: Monitor CD DVD activity on Windows machines (Data transfer) in Getting Data In

Monitor CD DVD activity on Windows machines (Data transfer)

sbettison — Mon, 22 Aug 2016 10:57:37 GMT

I am new to SPLUNK. Installed SPLUNK enterprise and have installed splunk forwarder on a workstation. Configured Data forwarder on Indexer to send Application, System and Security logs from the workstation. I want report on CD DVD activity on this client machine, and not sure how to do this. Is there a particular EVENT ID I should be using? I have copied data from DVD to the local machine and back again but cannot find any events. Is there something else I need to setup on the client machine?

Any help on this would be much appreciated.

Re: Monitor CD DVD activity on Windows machines (Data transfer)

jdonn_splunk — Tue, 23 Aug 2016 02:02:30 GMT

Does this help?:

https://www.eventtracker.com/wp-content/support-docs/How-to-Monitor-Removable-Media.pdf

Re: Monitor CD DVD activity on Windows machines (Data transfer)

sbettison — Wed, 24 Aug 2016 12:37:51 GMT

Thanks for reply and the link to EventTracker .. most useful