FileSure Defend for Splunk

FileSure Defend streams real-time file system audit events to Splunk via UDP syslog, giving security teams full visibility into file operations across Windows endpoints and servers. Each event captures the user, machine, file path, operation type, executable, and whether the action was allowed or denied — mapped to Splunk's Common Information Model. Deployed at U.S. national security facilities, FileSure Defend provides kernel-level file monitoring where traditional endpoint security falls short. Includes a pre-built dashboard, custom sourcetype (syslog_filesure), and field extractions out of the box.