Getting Data In

File Integrity Monitoring - Splunk 6

dgavic
Explorer

With FSChnage being deprecated in Splunk 5.0, what is the best method in Splunk 6 to monitor folder/file changes?

Thank you

Tags (3)
0 Karma

IT_Bullgod
Splunk Employee
Splunk Employee

The term Deprecation is misleading many of our customers. The fact remains - Splunk continues to maintain a file integrity checking feature through ver 5 and into the current version. See the link below:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

Hooshiar
Observer

Hello

The link is for version 6.0 and no longer exists.

"http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem"

You can use this link instead:
https://docs.splunk.com/Documentation/Splunk/9.2.2/Data/Monitorchangestoyourfilesystem
Although the contents of this document did not match the solution I wanted
In the SIM solution of ManageEngine company, it is possible to monitor a folder that has been Shared in such a way that if a file or folder is created, edited, renamed or deleted, it shows by which user and at what time and from which IP It happened.
I am looking for such a solution in Splunk

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. It's a veeeeeery old thread (over 10 years since last post)

2. Monitoring changes to filesystem is a completely different issue than logging changes on a file sharing platform (regardless of whether we're talking NFS, CIFS, DAV...). First thing would be to make sure that the service itself can and will log relevant data.

0 Karma

IT_Bullgod
Splunk Employee
Splunk Employee

The term Deprecation is misleading many of our customers. The fact remains - Splunk continues to maintain a file integrity checking feature through ver 5 and into the current version. See the link below:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

0 Karma

dgavic
Explorer

I did find this write up in the docs section, and this helped get me going in the right direction.

http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorfilesystemchangesonWindows

I am always open for more suggestions, or an easier way to do this.

Thank you

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...