- Splunk Answers
- :
- Splunk Platform Products
- :
- Splunk Enterprise
- :
- Re: Can Splunk Light tell me how many times a file...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can Splunk Light tell me how many times a file has been downloaded from a shared folder?
We use shared folders and I was wondering if Splunk or Splunk Light could tell me if a file was downloaded, when and by what user?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am Olivia Johnson, working as the senior seo executive Geeksscan company. I am managing all the seo activities of the company. For information you can visit our website and get the information. Here we will provide you only interesting content, which you will like very much. We’re dedicated to providing you the best of Informational, with a focus on dependability and Technology. We’re working to turn our passion for Informational into a booming online website. We hope you enjoy our Informational as much as we enjoy offering them to you.I will keep posting more important posts on my Website for all of you. Please give your support and love.
https://www.geeksscan.com/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you would need to turn on GP for that. Once you start getting audit logs for your users then you can add this stanza to all the forwarders (obviously with more details, like index)
[WinEventLog://Secuirty]
keep in mind this will be very noisy so a hefty blacklist will be needed.
config changes can be found here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We do have GP turned on, our issue is there's no details for when a file is downloaded specifically. We can tell when a file is accessed. Does that mean with Splunk we can get what we are looking for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
by downloaded do you mean copied....locally?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
either way the same applies you need to turn on audit logging for your file share
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have that I believe, I'm just confused where Splunk comes into play?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
do you have this stanza in your inputs.conf
[WinEventLog://Secuirty]
Introducing the Splunk Community Dashboard Challenge!
Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...
