Splunk File Integrity Monitoring (FIM) Implementation Guide
Overview
File Integrity Monitoring (FIM) detects unauthorized or unexpected changes to files on critical systems.
This article explains how to configure Windows Security Auditing and the Splunk Universal Forwarder (UF) to collect and analyze file activity events—Create, Modify, and Delete—in Splunk Enterprise or Splunk Enterprise Security (ES).
Prerequisites
- Windows Server 2019/2022 or Windows 10/1…
see more