Overview:

New policy criteria must be created in order to detect file system activity, and the detection engine must be updated to support a new stream of file system events, which may or may not be enriched with process/deployment information.

Requirements:

• Policies must support new fields for processing file system activity
• The detection engine must be able to process file system events with regard to the policies
  • The detection should work when the event has deployment information and when it only contains host/node information