Splunk Search

File Integrity Monitoring: How to search Read records where an individual accessed a document, not a folder?

fmpa_isaac
Path Finder

I am trying to report on a File Monitoring report that picks up all operations such as Read, Created, Wrote etc. However, I only want to see Read records where the individual accessed a document. I do not care about Read’s accessing a folder. Keeping in mind that I also want to see all other operation types. I’m thinking of a search command where the Read operation is within parenthesis looking specifically in the directory field for a File extension.

Here is my search criteria:

host = 10.0.0.3 "D:\\Data\\public\\human" | transaction user, _time | table  user, operation, directory, _time,
0 Karma

abrarfakhri
Path Finder

Guessing that operation value can be either Read, Created etc.
You can easily get "Read" by changing the query as follows:

host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | transaction user, _time | table  user, operation, directory, _time

Also, without knowing exactly what result set you're trying to get, my suggestion is not to use transaction but it is an expensive command.

You can use stats.

host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | stats  operation, directory, _time by user
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...