Greetings,
I'm utilizing Splunk Enterprise, and I'm wanting to audit whenever someone attempts to access and/or accesses the /var/log/audit folder on a Redhat 6.3 OS. Is there an already established SPL for this? Or does anyone have any suggestions?
V/R,
Cody
↧