Getting Data In

Any way to monitor excessive write activity to a server?

Path Finder

Greetings,

 

Is there any way to query Splunk to see if host disk drives have excessive write activity vs. read activity?  Trying to monitor for Ransomware infections.  Lots of write activity might indicate files being encrypted/modified.

I am a consumer of our Splunk environment so I don't have the ability to change the environment and I only have access to indexes for which my hosts reside.  For example I don't have access to the _internal index.  Thanks for any help.

Labels (4)
0 Karma

SplunkTrust
SplunkTrust

If you are logging disk read/write activity (not everyone does) then you should be able to query for excessive writes.  Such data would not be in the internal index, but I have no way of knowing where it is in your environment.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

Do you know what a search like that would look like?  I can check and see if those types of events show in the indexes my servers are forwarding to.  Thanks.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!