Splunk Search

Calculating file hashes and adding to events

grantlindley
New Member

Looking for the best way to implement the following use case:

Windows auditing is set up on a file share, so the addition of a file or an update to an existing file will create a Windows event 4663 with Accesses set to WriteData.

When splunk detects such an event, I want to calculate the hash of the file and add it to the event log so that it will be accessible via splunk searching. Alternatively, a new event could be created, as long as it has the timestamp, file path and name, and the hash value.

We have a simple splunk setup with a single splunk server and currently only universal forwarders. The file share is accessible from the splunk server, so the file hash could be calculated on the splunk server, itself. Alternatively, the hash could be calculated on the server with the file share, if that is easier.

I can't have a long time between the file addition/update and the calculation of the hash...less than a minute ideally.

Tags (1)
0 Karma

jplumsdaine22
Influencer

Do you want the hash of the file or the hash of the filename? The filename you can hash easily enough like | eval hash=md5(filename_field). There shouldn't be a need to index that - you can run it at search time.

If you want to calculate the hash of the file itself you'll need to do that with a scripted input - the universal forwarder by itself won't pull that from the event log (unless there is a windows event that contains that information)

There are most likely many answers on here about the best way to do malware monitoring - also check out the channel #security on the Splunk slack for more advice

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...