How to create a dashboard to show the use activity

[Mfmahdi]

How to create a dashboard to show the activities of the users specially uploading files. Kindly

[VatsalJagani]

@Mfmahdi - You can start by searching below into your internal logs, which has both file names that were uploaded and user names who uploaded it.

index=_internal "/services/receivers/stream"

From here you have to first complete the search query and click on save as dashboard from your search page.

I hope this helps!!!

[ITWhisperer]

What events have you ingested into Splunk?

[Mfmahdi]

we logs from linux and windows but most of our servers they are linux @ITWhisperer 

[ITWhisperer]

Please share some anonymised examples of the events you are interested in

[Mfmahdi]

I 'm not allowed to search any logs. but what we are looking for is a dashboard that show is any user is uploading files in our environment @ITWhisperer  

[ITWhisperer]

How do you propose to detect whether a file has been uploaded if you don't have access to any logs?

Please describe your environment in a bit more detail and what capabilities you do have.

[Mfmahdi]

we do have access to all the logs, we have PowerShell , sysmon and linux ...

we need to know is any user is uploading file through PowerShell or sysmon or any data source that usually the SOC can monitor. we need to create a dashboard that shows any files activity @ITWhisperer thank you in advance 

[ITWhisperer · Accepted solution]

Can you find by looking through your logs any data which indicates the behaviour you are looking for?