Alerting

How to trigger alert for when a host reaches out to a filepath

jhamot23
New Member

I'm looking to create a custom alert for when a host that should only be accessing a certain filepath, then reaches out to a filepath that it should not be accessing... So for example a host that should only be accessing C:\Documents\Newsletters\Summer2018 then accesses a seperate filepath of :\Projects\apilibrary, how can I create an alert for when the host accesses a filepath other than the one it should only be accessing? 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The exact mechanism depends on the data and the structure of the allow list, but it probably will entail fetching accesses and then using lookup to see if the access is on the allow list.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

jhamot23
New Member

This is just for Mac OS data, I do have a datasource that reports file accesses and a list of allowed file accesses. Just need some help getting the query right for alerting. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you have a data source that reports file accesses?  Do you have a list of allowed file accesses?  You'll need both of those in Splunk to set up an alert.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

rvany
Communicator

What kind of data are you working on? Which input are you using?

0 Karma