Alert whenever someone downloads certain file types

[kevinjb]

Hello, I want to create an alert whenever a network user downloads a certain file type from the internet to a share drive or local hard drive.

I'm having trouble getting my arms around how I would structure this search. What would you recommend I search for? There doesn't seem to be a Windows Event code for writing a file to disk.

Thanks for your time and advice.

[burakcinar]

Hi @kevinjb,

you have 3 option for logging. i prefer do it with web gateway logging .
1. web gateway log . (create policy on web gateway based on your filetype actions and send related logs via syslog or splunk app.)
2. access log for file servers . (you have use another 3rd party software for fileserver audit . you can alert for create file action but you need to filter events like created via internet browsers.)
3. windows events . (you can use sysmon for endpoint log collection. check Event ID 11: FileCreate for sysmon.)