Calculating file hashes and adding to events

[grantlindley]

Looking for the best way to implement the following use case:

Windows auditing is set up on a file share, so the addition of a file or an update to an existing file will create a Windows event 4663 with Accesses set to WriteData.

When splunk detects such an event, I want to calculate the hash of the file and add it to the event log so that it will be accessible via splunk searching. Alternatively, a new event could be created, as long as it has the timestamp, file path and name, and the hash value.

We have a simple splunk setup with a single splunk server and currently only universal forwarders. The file share is accessible from the splunk server, so the file hash could be calculated on the splunk server, itself. Alternatively, the hash could be calculated on the server with the file share, if that is easier.

I can't have a long time between the file addition/update and the calculation of the hash...less than a minute ideally.

[jplumsdaine22]

Do you want the hash of the file or the hash of the filename? The filename you can hash easily enough like | eval hash=md5(filename_field). There shouldn't be a need to index that - you can run it at search time.

If you want to calculate the hash of the file itself you'll need to do that with a scripted input - the universal forwarder by itself won't pull that from the event log (unless there is a windows event that contains that information)

There are most likely many answers on here about the best way to do malware monitoring - also check out the channel #security on the Splunk slack for more advice