How to create a File System Filter to target events for files with a specific string in their name (4320057)

This document provides the steps on how to create a File System events search for file that contains a specific string in their name. The example searches for the string "Encrypt"  but may be used to find any string.

To create the file system event search:

1. Open the Change Auditor Client and select the “Search” tab
2. Click “New” in the Button Bar menu, enter the desired name in the Search Name” field at the lower section (Info tab).
3. Select the “What” tab click the “Add” button in the properties menu
4.  Select each desired File System Event Classes and click “Add” to move each selection to the lower pane and click “OK”
5. Click the drop down (down arrow¸) to the right of the plus (+) in the properties menu)
6. Select any “SubSystem” | “FileSystem” from the context menu
7. Select “This Object” for the scope, “All Action” for “Actions” and “File” for the “type”
8. Enter “**Encrypt*” in the path (in this example “Encrypt” the string to find).
9. Click “Add” to move the string to the lower section and click “Ok”

This search pattern will find events (per configured Events Classes) for any file(s) (in audited path and sub-folders) that has the string “Encrypt” in their name.