Monitoring PDFs and Words files

Elastic Stack Beats
1

Good,

First of all ask for forgiveness if the question I'm going to ask is a bit stupid, but I can not find information about it.
Is it possible to monitor the records on a WORD or PDF document? As for example .. access, reading, deletion, copying ... etc
In case of being able .. What modification should I do about the .yml file?

Thank you very much in advance and greetings.

2

It's not possible to monitor files this way using Filebeat. However, Auditbeat has a file_integrity module which monitors the files on the OS. This is might be what you are looking for.

Getting started with Auditbeat: https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-getting-started.html
Configuring file_integrity module: https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file_integrity.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.