We use shared folders and I was wondering if Splunk or Splunk Light could tell me if a file was downloaded, when and by what user?
I am Olivia Johnson, working as the senior seo executive Geeksscan company. I am managing all the seo activities of the company. For information you can visit our website and get the information. Here we will provide you only interesting content, which you will like very much. We’re dedicated to providing you the best of Informational, with a focus on dependability and Technology. We’re working to turn our passion for Informational into a booming online website. We hope you enjoy our Informational as much as we enjoy offering them to you.I will keep posting more important posts on my Website for all of you. Please give your support and love.
https://www.geeksscan.com/
you would need to turn on GP for that. Once you start getting audit logs for your users then you can add this stanza to all the forwarders (obviously with more details, like index)
[WinEventLog://Secuirty]
keep in mind this will be very noisy so a hefty blacklist will be needed.
config changes can be found here
We do have GP turned on, our issue is there's no details for when a file is downloaded specifically. We can tell when a file is accessed. Does that mean with Splunk we can get what we are looking for?
by downloaded do you mean copied....locally?
either way the same applies you need to turn on audit logging for your file share
We have that I believe, I'm just confused where Splunk comes into play?
do you have this stanza in your inputs.conf
[WinEventLog://Secuirty]