https://community.splunk.com/t5/Splunk-Enterprise-Security/File-server-user-audit-logs-vs-Enterprise-Security/m-p/397870#M4444 <P>Hi there!</P> <P>We are receiving logs from a NetApp file server about what user access, etc. Log format very similar/same as the Windows Events in XML. (So parsing looks good) We also have Enterprise Security license.</P> <P>So far I didn't find what can ES do with these logs, one tip is to try to use Change Adult/Endpoint changes/Filesystem changes Data Model.</P> <P>So does anybody have an experience on this topic, what should I do with this logs?</P> <P>Regards,<BR /> István</P> Mon, 14 May 2018 11:34:39 GMT ikulcsar 2018-05-14T11:34:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/File-server-user-audit-logs-vs-Enterprise-Security/m-p/397870#M4444 <P>Hi there!</P> <P>We are receiving logs from a NetApp file server about what user access, etc. Log format very similar/same as the Windows Events in XML. (So parsing looks good) We also have Enterprise Security license.</P> <P>So far I didn't find what can ES do with these logs, one tip is to try to use Change Adult/Endpoint changes/Filesystem changes Data Model.</P> <P>So does anybody have an experience on this topic, what should I do with this logs?</P> <P>Regards,<BR /> István</P> Mon, 14 May 2018 11:34:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/File-server-user-audit-logs-vs-Enterprise-Security/m-p/397870#M4444 ikulcsar 2018-05-14T11:34:39Z