Can Packetbeat just be used to show traffic going from a server?

Elastic Stack Beats
1

Not a network expert at all, but have some monitoring set up using Auditbeat and the Elastic Stack.

We are interest in identifying files that are being transferred of a server, what the file is called, who requested it and where it is being transferred to.

Is this something Packetbeat can help with?"

2

What protocols are being used to make these request for files? Are any of them listed at https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html?

3

Hi Andrew. Thanks for getting back to me.

Not 100% sure, but I can try and find out. There are probably 2 main types of thing we are trying to monitor.

  • Access via a mapped network drive (Samba or smb)
  • Access via an SFTP client such as Filezilla

Not sure which protocols either of these will use, but will try and find out.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.