Monitor .Exe files - Splunk Community

Getting Data In

Hey Guys,

is there a quick and easy way to monitor .exe within the Windows sys32 folder via a stanza ?

I need to know if the file is ran / closed / renamed or moved

I tried the [monitor] stanza but it looks like that only monitors the file contents i.e. file edits

Thank you

Probably the security events might help you

Reference : http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorfilesystemchangesonWindows

---
What goes around comes around. If it helps, hit it with Karma 🙂

Thank you i'll take a look at this option. 🙂

Get Updates on the Splunk Community!

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...