File server
This tutorial is your guide to understanding and implementing effective file server monitoring and securing techniques using EventLog Analyzer.
Before diving into audit reports and activating detection rules, it's crucial to establish a solid monitoring foundation for your file server. This involves configuring logging settings and integrating them seamlessly with the EventLog Analyzer console.
Throughout this tutorial, we'll focus on practical strategies for monitoring your file server, helping you detect anomalies and track file access patterns to maintain data integrity.
Securing Windows and Linux file servers: A log-based approach with EventLog Analyzer
EventLog Analyzer covers the below file server auditing use cases with its security auditing reports. These reports are predefined and can be scheduled to be generated at specific times and distributed over email. EventLog Analyzer supports file servers on both Windows and Linux platforms.
| Use Case | Description | Why implement? | Available Reports |
|---|---|---|---|
| Windows File Monitoring | Track user interactions, file modifications, and access attempts, both in real time and retrospectively. Detect suspicious behavior, prevent unauthorized access, and maintain the integrity of your critical data assets. | Enhance security, facilitate auditing, and ensure compliance by keeping tabs on file access, modification, deletion, and creation. |
|
| Linux File Monitoring | Use various system-level mechanisms and tools to observe and analyze changes occurring within the Linux file system. | Implement file monitoring on a Linux system to ensure security, compliance, integrity, incident response, proactive maintenance, and auditing. |
|
Threat detection use cases
The table below outlines the preconfigured threat detection scenarios supported for the file server platform through EventLog Analyzer. Additionally, our solution provides a customizable correlation rule builder, empowering users to craft their own detection rules.
| Use Case | Event Type | Relevant MITRE ATT&CK TTPs | Detection Rules |
|---|---|---|---|
| Unexpected Access Loss | Microsoft-Windows-Security-Auditing - 4670 |
|
|
| Accidental File Deletions | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 |
|
|
| Malware detection (both commodity and targeted attacks) | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 |
|
All File Monitoring Reports |
| File Tampering | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 |
|
|
| Ransomware Detection | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 |
|
Correlation Reports > File integrity threats > Possible ransomware activities |
Data security use cases
The below table elaborates the data security use cases covered by EventLog Analyzer for file server platforms.
| Use case | Event type | Relevant MITRE ATT&CK TTPs | Detection rules |
|---|---|---|---|
| Pre-Departure Data Exfiltration | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 |
|
|
| Sensitive Data Auditing | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 | ID: M0941 | This can be achieved by adding custom reports with the criteria Access equals object accessed |
| Data Sabotage | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 |
|
|
| Data Breach Prevention | Microsoft-Windows-Security-Auditing - 560, 562, 564, 567, 4656, 4658, 4660, 4663, 5145, 4670 | ID: M0803 | All File Monitoring Reports |
Compliance
Most regulatory mandates require organizations to deploy file monitoring solutions to track file access and modifications, and ensure data security and integrity. The below table illustrates how EventLog Analyzer can help you meet compliance use cases. For detailed solution mapping, check out this space.
Compliance requirement: Solution mapping for file server platform
| EventLog Analyzer reports and alerts | Detection rules | Regulatory mandates | Requirements |
|---|---|---|---|
|
|
FISMA | Audit and Accountability (AU) |
| PCI-DSS |
|
||
| SOX | SEC 302 (a) (5) (A) | ||
| HIPAA | 164.308 (a) (1) (ii) (D) | ||
| ISO 27001:2013 |
|
||
| ISLP |
|
||
| GDPR |
|
||
| NRC |
|
||
| CCPA and CPRA | Section 1798.150.(a) | ||
| FERPA | Section 99.31 (a)(1)(ii) | ||
| PDPA |
|
||
| NIST CSF | Data Security (PR.DS) | ||
| POPIA |
|
||
| QCF |
|
||
| TISAX | 5.2.4 | ||
| CJDN | Application Development | ||
| UAE-NESA |
|
||
| SOC 2 |
|
||
|
|
||
| FISMA | Audit and Accountability (AU) | ||
| PCI DSS |
|
||
| HIPAA | 164.308 (a) (1) (ii) (D) | ||
| ISO 27001:2013 |
|
||
| GPG |
|
||
| ISLP | ARTICLE 12 | ||
| NRC |
|
||
| COCO | 1.D.Protective monitoring and intrusion detection | ||
| CCPA and CPRA | Section 1798.150.(a) | ||
| FERPA | Section 99.31 (a)(1)(ii) | ||
| PDPA |
|
||
| NIST CSF | Data Security (PR.DS) | ||
| CMMC |
|
||
| POPIA |
|
||
| QCF |
|
||
| SOC 2 |
|
