# Audit partage de fichier

**URL:** <https://discuss.elastic.co/t/audit-partage-de-fichier/224389>\
**Category:** Discussions en français\
**Created:** [March 20, 2020, 9:32am UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389 "2020-03-20T09:32:53Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![david\_oliver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oliver/32/64796_2.png) [@david\_oliver](https://discuss.elastic.co/u/david_oliver)\
**Post date:** [March 20, 2020, 9:32am UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/1 "2020-03-20T09:32:53Z")

</div>

Bonjour,

J'ai un serveur de fichier j aimerai auditer qui a fais quoi : ajout, modification et suppression.

j ai activé les audits file system et file share, je recois bien les log dans kibana avec winlogbeat et elastic mais je l'ai trouve peu explicite.

j'aurai aimer savoir si il y a un autre moyen d'auditer un partage de fichier avec un autre beats ou une autre méthode

Merci par avance de vos réponse

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2020, 11:15am UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/2 "2020-03-20T11:15:47Z")

</div>

Bienvenue !

Regarde si Auditbeat te permettrait d'obtenir ce que tu cherches.

---

<div class="post-metadata">

**Author:** ![ahmed\_charafouddine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ahmed_charafouddine/32/45129_2.png) [@ahmed\_charafouddine](https://discuss.elastic.co/u/ahmed_charafouddine)\
**Post date:** [March 20, 2020, 1:14pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/3 "2020-03-20T13:14:02Z")

</div>

Oui, je pense aussi que le module File Integrity de auditbeat devrait être une solution.  
_Complement : + filebeat module system file_

---

<div class="post-metadata">

**Author:** ![david\_oliver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oliver/32/64796_2.png) [@david\_oliver](https://discuss.elastic.co/u/david_oliver)\
**Post date:** [March 20, 2020, 1:27pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/4 "2020-03-20T13:27:06Z")

</div>

Super merci de vos retour je me mets sur c est deux modules et je vous tiens au courant de mon avancé

---

<div class="post-metadata">

**Author:** ![david\_oliver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oliver/32/64796_2.png) [@david\_oliver](https://discuss.elastic.co/u/david_oliver)\
**Post date:** [March 20, 2020, 2:57pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/5 "2020-03-20T14:57:04Z")

</div>

Auditbeat avec le file integrity est plus explicite sur l action faite le problème est qu'il n y a pas le user qui a fait l action

ex : j'ai le bon nom de fichier si il a était modifier crée ou supprimer mais je ne sais pas par qui

Avez-vous une idée pour le récupérer ?

Merci

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2020, 3:13pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/6 "2020-03-20T15:13:21Z")

</div>

Hmmmm. Il me semble que ça me donne sur Linux.

---

<div class="post-metadata">

**Author:** ![david\_oliver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oliver/32/64796_2.png) [@david\_oliver](https://discuss.elastic.co/u/david_oliver)\
**Post date:** [March 20, 2020, 3:41pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/7 "2020-03-20T15:41:16Z")

</div>

la sur windows après plusieurs test en changent d'user je n'ai rien qui remonte je suis en 7.6.0

Configuration aditbeat

```auto
auditbeat.modules:

- module: file_integrity
  paths:
  #- C:/windows
  #- C:/windows/system32
  #- C:/Program Files
  #- C:/Program Files (x86)
  - E:/Shares/partage
  recursive: true

```

Voila se que je récupère

```auto
{
  "_index": "auditbeat-7.6.0-2020.03.18-000016",
  "_type": "_doc",
  "_id": "wfRo-HABJaqY5W-aFN4f",
  "_score": 1,
  "_source": {
    "@timestamp": "2020-03-20T14:40:54.447Z",
    "hash": {
      "sha1": "e1a48afd3a1cb093f351e8a2aa4cd187789e1a14"
    },
    "host": {
      "architecture": "x86_64",
      "name": "AD.local",
      "os": {
        "build": "17763.1098",
        "platform": "windows",
        "version": "10.0",
        "family": "windows",
        "name": "Windows Server 2019 Standard",
        "kernel": "10.0.17763.1098 (WinBuild.160101.0800)"
      },
      "id": "cb469dd3-17b9-430b-b98f-cda1367b0588",
      "hostname": "AD"
    },
    "agent": {
      "version": "7.6.0",
      "name": "AD.local",
      "type": "auditbeat",
      "ephemeral_id": "5baeeea9-9ced-4f3d-afef-25af3b226f0a",
      "hostname": "AD",
      "id": "3d114794-e4eb-44e4-b0a0-e76c5ac3cdd1"
    },
    "ecs": {
      "version": "1.4.0"
    },
    "event": {
      "module": "file_integrity",
      "dataset": "file",
      "action": [
        "updated"
      ]
    },
    "service": {
      "type": "file_integrity"
    },
    "file": {
      "size": 7,
      "type": "file",
      "uid": "S-1-5-21-1808165017-3226825159-2693320066-2674",
      "owner": "AD\\david",
      "path": "E:\\Shares\\partage\\david.txt",
      "inode": "281474976710723",
      "mtime": "2020-03-20T14:40:54.435Z",
      "ctime": "2020-03-20T14:39:14.793Z"
    }
  },
  "fields": {
    "file.ctime": [
      "2020-03-20T14:39:14.793Z"
    ],
    "@timestamp": [
      "2020-03-20T14:40:54.447Z"
    ],
    "file.mtime": [
      "2020-03-20T14:40:54.435Z"
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 20, 2020, 4:05pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/8 "2020-03-20T16:05:21Z")

</div>

Ca vaudrait le coup d'ouvrir d'un bug sur [https://github.com/elastic/beats](https://github.com/elastic/beats) ?

---

<div class="post-metadata">

**Author:** ![david\_oliver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oliver/32/64796_2.png) [@david\_oliver](https://discuss.elastic.co/u/david_oliver)\
**Post date:** [March 20, 2020, 4:23pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/9 "2020-03-20T16:23:13Z")

</div>

Suite a mes recherche je suis tomber sur ça je pense qu'un bug a déjà était ouvert

> <https://github.com/elastic/beats/issues/12761>
>
> To enable us know user who made changes to a file or folder in the file integrity monitoring

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2020, 4:23pm UTC](https://discuss.elastic.co/t/audit-partage-de-fichier/224389/10 "2020-04-17T16:23:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.