SANRE for Windows

[longbowman]

We are trying to use SNARE for Windows to send events to a Syslog server. The problem seems to be that SNARE is not grabbing file/folder activity. We have it set to capture these and these events do show in the Windows Event  log but SNARE is not showing any activity. I am using SNARE 3.1.3 and have tried 3.1.7 but still no luck.
Any one have any success with this? Perhaps there is a different Event capture utility to try?

[Admin]

Just to clarify - you have set the windows audit policy to monitor file & folder activity, and you see the results in eventlog, but those logs are not being passed to snare?

I suspect Snare may not be set to capture those.  I wonder if ntsyslog would?

[longbowman]

Yes the Windows event viewer shows the auditing occurring just fine. Snare shows nothing. I have even tried just capturing events 650, 654 but still no luck.