Splunk Search

File Integrity Monitoring: How to search Read records where an individual accessed a document, not a folder?

fmpa_isaac
Path Finder

I am trying to report on a File Monitoring report that picks up all operations such as Read, Created, Wrote etc. However, I only want to see Read records where the individual accessed a document. I do not care about Read’s accessing a folder. Keeping in mind that I also want to see all other operation types. I’m thinking of a search command where the Read operation is within parenthesis looking specifically in the directory field for a File extension.

Here is my search criteria:

host = 10.0.0.3 "D:\\Data\\public\\human" | transaction user, _time | table  user, operation, directory, _time,
0 Karma

abrarfakhri
Path Finder

Guessing that operation value can be either Read, Created etc.
You can easily get "Read" by changing the query as follows:

host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | transaction user, _time | table  user, operation, directory, _time

Also, without knowing exactly what result set you're trying to get, my suggestion is not to use transaction but it is an expensive command.

You can use stats.

host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | stats  operation, directory, _time by user
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...