SEAL EventLog Filter #1.00

[PROPERTIES]
Title=File audit
MinOSVer=6.0

[DESCRIPTION]
File Access Audit. 
For using this rule must be enabled: 
1. "Audit objects access" in Local Security Policy (Local Policies -> Audit Policy). 
2. Auditing on selected directories, files (Security tab in Properties).  

Attention : After enabling "Audit object access" many other events are logged, we recommend to disable them. We also recommend increase size of Security Event Log.
	



[GROUP]
Name        =FileAudit
Description =Auditing files by local policy
Color       =Fuchsia


[RULE]
Channel  =TXT:Security
Publisher=TXT:Microsoft-Windows-Security-Auditing
EventID  =4663

SET Message =Account: %3\%2 Logon ID: %4 Object Name: %7 Process Name: %12 Access: %9
SET Group   =FileAudit
