topic Re: Copy and Paste search string in Splunk Search

Copy and Paste search string

daviess158 — Wed, 30 Sep 2020 00:43:46 GMT

Hi!
I am trying to create a report which I will use as a dashboard panel, to show me who has been copying and pasting files and folders. I want to know what has been copied and pasted, and where they have been pasted to. So far I have managed to look at all files read and written but I am unable figure out how to close my search down to show me only instances that have both "read" and "write" Accesses, or Is there a better way to do this? My search string in progress is below:

index=windowslogindex EventCode=4663 AND Object_Type=File Accesses="ReadData (or ListDirectory)" | Append [search index=windowslogindex EventCode=4663 AND Object_Type=File Accesses="WriteData (or AddFile)"]

Re: Copy and Paste search string

siddharthkhatsu — Sat, 01 Jun 2019 12:15:49 GMT

index=windowslogindex EventCode=4663 AND Object_Type=File Accesses="ReadData (or ListDirectory)"  OR Accesses="WriteData (or AddFile)" | stats dc(Accesses) as Count by "Insatnce ID or filename"

now where ever count = 2 those files will have logs for both read and write accesses.

I hope this helps.

Re: Copy and Paste search string

daviess158 — Wed, 26 Jun 2019 13:54:39 GMT

Hi Sidd
Thanks, sorry for the late reply, I haven't been able to get online for a while!
I was wondering why the info in the second line was grey'd out, I have tried the string you suggested but nothing comes up in the statistics tab nothing shows.
Can you tell me if there is something else I can try? or help me amend the string please?
Stu

Re: Copy and Paste search string

niketn — Wed, 26 Jun 2019 15:42:37 GMT

@daviess158 which is the field that will give you unique filename?

Instead of writing the append (which will have subsearch limitation you can just bring the data from index for both Read and Write access

 index=windowslogindex EventCode=4663 AND Object_Type=File (Accesses="ReadData (or ListDirectory)" OR Accesses="WriteData (or AddFile)")

Then if the file name fields is filename(provide the actual file name field based on your indexed data) for example you can get the Access Types using stats command. Finally through a search find out events which have both Read and Write access.

| stats values(Accesses) as Accesses by filename
| search Accesses="ReadData (or ListDirectory)" AND Accesses="WriteData (or AddFile)")

Following is a run anywhere example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=* (log_level="WARN" OR log_level="ERROR") 
| stats values(log_level) as log_level by component 
| search log_level="WARN" AND Accesses="ERROR"