https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289157#M55194 <P>I don't have proxy logs, but I do have ids/firewalls etc and I want to create a search that will identify when a user has downloaded tools such as nmap, kali etc. any ideas?</P> Fri, 16 Feb 2018 19:03:35 GMT Ghanayem1974 2018-02-16T19:03:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289157#M55194 <P>I don't have proxy logs, but I do have ids/firewalls etc and I want to create a search that will identify when a user has downloaded tools such as nmap, kali etc. any ideas?</P> Fri, 16 Feb 2018 19:03:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289157#M55194 Ghanayem1974 2018-02-16T19:03:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289158#M55195 <P>Some IDS tools have options for alerting on such downloads. What IDS tools are you using, and are they deployed in a location to view users' web traffic?</P> Fri, 16 Feb 2018 20:51:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289158#M55195 elliotproebstel 2018-02-16T20:51:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289159#M55196 <P>cisco firesight i am able to see that urls are being captured just not many.</P> Fri, 16 Feb 2018 21:22:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-search-that-will-identify-when-a-user-has/m-p/289159#M55196 Ghanayem1974 2018-02-16T21:22:16Z