topic Re: Monitor Stanza in Getting Data In

Monitor Stanza

jwray97 — Wed, 30 Sep 2020 03:26:08 GMT

I am having trouble with one my monitor stanza's. I am trying to monitor a log file for AV threats. I am using 2 stanza's one to monitor the threats and one to change the files to a quarantined file, the quarantined stanza works straight away as soon as a AV breach is found however there is a few hours delay in the monitor threat coming through. I am using the below inputs,

"Monitor Stanza to capture events written to VA log"
[monitor://C:\Program Files (x86)\Trend Micro\OfficeScan Client\Misc\pccnt35.log]
disabled = 0
pollPeriod = 120
source = localhost_av
sourcetype = av_threat
index=av

"AV Quarantine Directory for any new files that have been dropped in by the AV Client"
[fschange:C:\Program Files (x86)\Trend Micro\OfficeScan Client\SUSPECT]
disabled = 0
pollPeriod = 30
source = localhost_av
sourcetype = av_quarantine
index=av

The threat is writing to the log file in the AV application straight away but it seems to take a few hours sometimes even days for visibility in Splun

Re: Monitor Stanza

martin_mueller — Tue, 24 Dec 2019 13:17:28 GMT

Note, fschange has been deprecated for over seven years.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorchangestoyourfilesystem

Re: Monitor Stanza

woodcock — Wed, 30 Sep 2020 03:26:14 GMT

The generic name for this is File Integrity Monitoring and, as @martin_mueller noted, it was deprecated in a partly working state because Splunk simply could not make it work reliably. If it works for you, GREAT! If not, you need to do something else because it is what it is. Now that you know the name of the idea, you can research other tools and send the output of these tools into Splunk. You can start here:
https://en.wikipedia.org/wiki/File_integrity_monitoring

Re: Monitor Stanza

jwray97 — Fri, 27 Dec 2019 08:44:41 GMT

Thanks guys appreciate you help with this one. I will research the other tools and go from there!!

Many Thanks!