Splunk Enterprise

Can Splunk Light tell me how many times a file has been downloaded from a shared folder?

New Member

We use shared folders and I was wondering if Splunk or Splunk Light could tell me if a file was downloaded, when and by what user?

0 Karma

Contributor

you would need to turn on GP for that. Once you start getting audit logs for your users then you can add this stanza to all the forwarders (obviously with more details, like index)

[WinEventLog://Secuirty]

keep in mind this will be very noisy so a hefty blacklist will be needed.

config changes can be found here

0 Karma

New Member

We do have GP turned on, our issue is there's no details for when a file is downloaded specifically. We can tell when a file is accessed. Does that mean with Splunk we can get what we are looking for?

0 Karma

Contributor

by downloaded do you mean copied....locally?

0 Karma

Contributor

either way the same applies you need to turn on audit logging for your file share

0 Karma

New Member

We have that I believe, I'm just confused where Splunk comes into play?

0 Karma

Contributor

do you have this stanza in your inputs.conf
[WinEventLog://Secuirty]

0 Karma