Filter for specific folder activity

Elastic Stack Beats
1

Hello I wanted to know if it's possible to add a filter in winlogbeat to only have the activity of a specific folder and all it's files inside it, and itself by the way if the folder is renamed, deleted or something else.

For example I filtered all winlogbeat data with :

  • One host (host.ip) ip of the server where I created a share folder with an file audit on to get the logs in the event viewer.

  • One kind of event.codes : 4663 (An attempt was made to access an object)

  • Where this happened (winlog.event_data.ObjectName) which is the path to the file or folder (the object) where something happened

  • Maybe the action in the "message" field like DELETE for example

I can do this for each files but not all files like * after the folder path C:\Program Files\Test ELK\*

1
11913×886 107 KB

2
21382×676 93.9 KB

3
31461×693 56.3 KB

And it doesn't works with "*" after the "\"

I also tried this but the query isn't accepted

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.