How to create a search that will identify when a u...

Ghanayem1974 · ‎02-16-2018

I don't have proxy logs, but I do have ids/firewalls etc and I want to create a search that will identify when a user has downloaded tools such as nmap, kali etc. any ideas?

elliotproebstel · ‎02-16-2018

Some IDS tools have options for alerting on such downloads. What IDS tools are you using, and are they deployed in a location to view users' web traffic?

Ghanayem1974 · ‎02-16-2018

cisco firesight i am able to see that urls are being captured just not many.

How to create a search that will identify when a user has downloaded hacking domain tools?

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Are you a member of the Splunk Community?

How to create a search that will identify when a user has downloaded hacking domain tools?

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0