How to create a search that will identify when a user has downloaded hacking domain tools?

[Ghanayem1974]

I don't have proxy logs, but I do have ids/firewalls etc and I want to create a search that will identify when a user has downloaded tools such as nmap, kali etc. any ideas?

[elliotproebstel]

Some IDS tools have options for alerting on such downloads. What IDS tools are you using, and are they deployed in a location to view users' web traffic?

[Ghanayem1974]

cisco firesight i am able to see that urls are being captured just not many.