Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Monitor Stanza
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am having trouble with one my monitor stanza's. I am trying to monitor a log file for AV threats. I am using 2 stanza's one to monitor the threats and one to change the files to a quarantined file, the quarantined stanza works straight away as soon as a AV breach is found however there is a few hours delay in the monitor threat coming through. I am using the below inputs,
"Monitor Stanza to capture events written to VA log"
[monitor://C:\Program Files (x86)\Trend Micro\OfficeScan Client\Misc\pccnt35.log]
disabled = 0
pollPeriod = 120
source = localhost_av
sourcetype = av_threat
index=av
"AV Quarantine Directory for any new files that have been dropped in by the AV Client"
[fschange:C:\Program Files (x86)\Trend Micro\OfficeScan Client\SUSPECT]
disabled = 0
pollPeriod = 30
source = localhost_av
sourcetype = av_quarantine
index=av
The threat is writing to the log file in the AV application straight away but it seems to take a few hours sometimes even days for visibility in Splun
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The generic name for this is File Integrity Monitoring and, as @martin_mueller noted, it was deprecated in a partly working state because Splunk simply could not make it work reliably. If it works for you, GREAT! If not, you need to do something else because it is what it is. Now that you know the name of the idea, you can research other tools and send the output of these tools into Splunk. You can start here:
https://en.wikipedia.org/wiki/File_integrity_monitoring
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks guys appreciate you help with this one. I will research the other tools and go from there!!
Many Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The generic name for this is File Integrity Monitoring and, as @martin_mueller noted, it was deprecated in a partly working state because Splunk simply could not make it work reliably. If it works for you, GREAT! If not, you need to do something else because it is what it is. Now that you know the name of the idea, you can research other tools and send the output of these tools into Splunk. You can start here:
https://en.wikipedia.org/wiki/File_integrity_monitoring
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Note, fschange has been deprecated for over seven years.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorchangestoyourfilesystem
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
