Monitoring permission changes in a directory with Splunk

[cliccardi]

Hello Splunkers...
I have a request from a department to use Splunk to monitor a directory for permission changes/alterations.

Is this possible? If so, HELP lol

New to the Splunk-verse so forgive the n00b question.

[Ayn]

There's deprecated functionality called "fschange" in Splunk that does this. But, being deprecated, I advise against using it. You should look into using native tools to the OS that you're running like object access auditing in Windows or auditd in Linux.