Splunk Search

File Integrity Monitoring: How to search Read records where an individual accessed a document, not a folder?

fmpa_isaac
Path Finder

I am trying to report on a File Monitoring report that picks up all operations such as Read, Created, Wrote etc. However, I only want to see Read records where the individual accessed a document. I do not care about Read’s accessing a folder. Keeping in mind that I also want to see all other operation types. I’m thinking of a search command where the Read operation is within parenthesis looking specifically in the directory field for a File extension.

Here is my search criteria:

host = 10.0.0.3 "D:\\Data\\public\\human" | transaction user, _time | table  user, operation, directory, _time,
0 Karma

abrarfakhri
Path Finder

Guessing that operation value can be either Read, Created etc.
You can easily get "Read" by changing the query as follows:

host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | transaction user, _time | table  user, operation, directory, _time

Also, without knowing exactly what result set you're trying to get, my suggestion is not to use transaction but it is an expensive command.

You can use stats.

host = 10.0.0.3 "D:\\Data\\public\\human" operation="Read" | stats  operation, directory, _time by user
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...