I'm looking to create a custom alert for when a host that should only be accessing a certain filepath, then reaches out to a filepath that it should not be accessing... So for example a host that should only be accessing C:\Documents\Newsletters\Summer2018 then accesses a seperate filepath of :\Projects\apilibrary, how can I create an alert for when the host accesses a filepath other than the one it should only be accessing?
The exact mechanism depends on the data and the structure of the allow list, but it probably will entail fetching accesses and then using lookup to see if the access is on the allow list.
--- If this reply helps you, Karma would be appreciated.
This is just for Mac OS data, I do have a datasource that reports file accesses and a list of allowed file accesses. Just need some help getting the query right for alerting.
Do you have a data source that reports file accesses? Do you have a list of allowed file accesses? You'll need both of those in Splunk to set up an alert.
--- If this reply helps you, Karma would be appreciated.
