Monitor Stanza

[jwray97]

I am having trouble with one my monitor stanza's. I am trying to monitor a log file for AV threats. I am using 2 stanza's one to monitor the threats and one to change the files to a quarantined file, the quarantined stanza works straight away as soon as a AV breach is found however there is a few hours delay in the monitor threat coming through. I am using the below inputs,

"Monitor Stanza to capture events written to VA log"
[monitor://C:\Program Files (x86)\Trend Micro\OfficeScan Client\Misc\pccnt35.log]
disabled = 0
pollPeriod = 120
source = localhost_av
sourcetype = av_threat
index=av

"AV Quarantine Directory for any new files that have been dropped in by the AV Client"
[fschange:C:\Program Files (x86)\Trend Micro\OfficeScan Client\SUSPECT]
disabled = 0
pollPeriod = 30
source = localhost_av
sourcetype = av_quarantine
index=av

The threat is writing to the log file in the AV application straight away but it seems to take a few hours sometimes even days for visibility in Splun

[jwray97]

Thanks guys appreciate you help with this one. I will research the other tools and go from there!!

Many Thanks!

[woodcock · Accepted solution]

The generic name for this is File Integrity Monitoring and, as @martin_mueller noted, it was deprecated in a partly working state because Splunk simply could not make it work reliably. If it works for you, GREAT! If not, you need to do something else because it is what it is. Now that you know the name of the idea, you can research other tools and send the output of these tools into Splunk. You can start here:
https://en.wikipedia.org/wiki/File_integrity_monitoring

[martin_mueller]

Note, fschange has been deprecated for over seven years.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Monitorchangestoyourfilesystem