Monitor a file in a folder

[anandhalagarasa]

Hi Team,

We have an requirement to monitor the files is getting deleted or modified or added into a folder then we need to get an splunk alert stating that who has modified the file or deleted the folder.

Consider an example:

We have an shared Drive (D) in a windows server in that we have multiple folders like (A),(B) and (C). In that when we go to folder (A) inside there would be multiple files (might be log file or any other files) like x.log, y.csv and z.xlsx.

So we want to get notified if any of the files say (x.log) is getting deleted or modified in that particular folder (A) and we want to know who has deleted or modified the file.

Is it possible to achieve in Splunk?

If yes kindly let me know how to proceed the same.

[mayurr98]

for that, I think you would need to index audit file logs into Splunk.
Refer this blog to turn on object access auditing.
See if this helps

1. detect any file that has been deleted (gone from the server, not moved to a sub-directory or something)
   Event Code=4663 AND Accesses= DELETE AND Object Type=File

2. detect any modification made to a file
   Event Code=4663 AND Accesses= WriteData AND Object Type=File

3. detect any readings on files
   http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/

let me know if this helps!