Getting Data In

Can Splunk do File Integrity Monitoring on its own in 2017?

Explorer

I'm not being able to find consice information, since every post just links to this DEPRECATED feature: docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

I want to be able to log (and then alert) if a change is noticed in a file (usually implemented via scheduled hash checks, but it doesn't matter). Is that possible, or not any more and I would need to pay for other services for that feature?

The other doc that gets usually linked is this: docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesystemchangesonWindows
but the instructions make it seem like I can't use a Universal Forwarder and I must have another full fledged installation of splunk enterprise?
also the instructions have a crucial step where they link to a Microsoft Doc, but that link is completely dead, so it's missing instructions.

Can someone please clarify all this mess for me? I would really appreciate it.

Engager

Hi, seems there's another way located at http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorfilesystemchangesonWindows
to address the deprecated feature.
Cheers, Desmond.

Engager

Hi,
I did a quick find, and noticed version 7.1.0 provides a way .. and you may have a look at https://docs.splunk.com/Documentation/Splunk/7.1.0/Data/MonitorfilesystemchangesonWindows
Hope this helps.
Cheers, Desmond.

0 Karma