Splunk Search

View large data downloads

Fei
New Member

What command would I use to check if anyone has downloaded a large file(s) before they were terminated?

Labels (1)
0 Karma

kennetkline
Path Finder

Not enough information to go on;

Not much help I can provide; unless could confirm similar tools sources I may have be familar with.

I recommend to approach the issue internally with these thoughts, unless can get some specifics tools / sources that are available that would potentially have the evidence.

To that point:

Do you have a tools in your environment and/or the necessary logging to generate an event; 

1. Any DLP tools that detect (transfer files to/from endpoint to cloud storage, usb, etc)?
2. Any Proxy servers or other that can detect, and on track usage by user.
3. Email logging
4. Splunk UF on the endpoints
5. Host base firewall on endpoint.

My thoughts;
1. Any DLP solution exist you, maybe configured to alert; and probably not asking this.
2. If you don't know the in's and outs of what data you have or where to look and the individual is gone and you have the device;   digital media analysis/forensics is on option.
3.  If you have email logs then looks for anything from sender and not to agency with large file.
4. If Splunk Logging of endpoint with UF and depending on the level of logging.  I would analyze for dns logs / ip as to connections to cloud sources.


0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...