Monitor administrator in network folders

Elastic Stack Beats
1

Hi All,

I have query on this .
Do we have any beats or something to monitor administrator access to specific network folders?

We have a variety of classic network drives, one of which must be monitored.

Need: If an administrator edits permissions on the folder, or reads / edits files in the folder, an email must be sent to person ABC.

The solution must in some way be protected from being disabled by a domain admin, via a different code or similar.

Thanks,
Raj

2

I wonder if this is something auditbeat could do (@andrewkroh)?

3

I think this could be done by using the built-in Windows auditing features. You can enable auditing for a particular actions on certain resources and then Windows will write an audit event to the event log. Then you can use Winlogbeat to read those events.

The email could be sent by the Alerting feature in X-Pack.

4

Thank you guys :smile: