topic Re: Find who delete files and folders in General Discussion

Find who delete files and folders

Mr_Benett — Fri, 24 Jan 2020 14:15:41 GMT

Hello everyone,

I would like to know if it's possible to know who deleted a folder or a file with windows explorer (CIFS) on the NetApp.

Is it possible to watch this with logs or job history ?

Thank you !

Re: Find who delete files and folders

SpindleNinja — Fri, 24 Jan 2020 14:27:19 GMT

Yep, you can audit CIFS/SMB events. Here's a good place to start.

https://docs.netapp.com/ontap-9/topic/com.netapp.doc.dot-cifs-nfs-audit/home.html

Re: Find who delete files and folders

wareer — Mon, 16 Dec 2024 05:01:10 GMT

NAS file systems occupy an increased footprint in today's threat landscape, audit functions are critical to support visibility.

Security requires validation. ONTAP 9 provides increased auditing events and details across the solution. Because NAS file systems occupy an increased footprint in today's threat landscape, audit functions are critical to support visibility. Because of the improved audit capability in ONTAP 9, CIFS audit details are more plentiful than ever. Key details, including the following, are logged with events created:

File, folder, and share access
Files created, modified, or deleted
Successful file read access
Failed attempts to read or write files
Folder permission changes

Below are links to relevant official documents：https://docs.netapp.com/us-en/ontap/ontap-security-hardening/filesystem-auditing.html