Alerting

Use case to track the file deletion from windows files hare

msplunk33
Path Finder

I need to setup an alert to track when ever someone delete any file from a shareholder from windows 2016 file server. I need to know which log need to ingest to Splunk for setting up this alert. If you have the splunk query for this that will be help full.

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

 Hi @msplunk33,
Follow this link to setup auditing windows files deletion: https://www.lepide.com/how-to/track-file-deletions-and-permission-changes-on-file-servers.html

Then forward the Windows Security event logs (with event ID 4663) to Splunk using [WinEventLog://Security] monitor. Check this answer for doing this: https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-collect-basic-Windows-OS-Event-Log-dat...

If this reply helps you, a like would be appreciated.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

 Hi @msplunk33,
Follow this link to setup auditing windows files deletion: https://www.lepide.com/how-to/track-file-deletions-and-permission-changes-on-file-servers.html

Then forward the Windows Security event logs (with event ID 4663) to Splunk using [WinEventLog://Security] monitor. Check this answer for doing this: https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-collect-basic-Windows-OS-Event-Log-dat...

If this reply helps you, a like would be appreciated.

View solution in original post

jotne
Path Finder

This search may give you some:

source="WinEventLog:Security" sourcetype=WinEventLog EventCode=4656 Accesses=DELETE Object_Type=File

 

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!