Query: os_file_access

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- Unix/Linux sensitive files
    request_uri ilike '%/etc/passwd%'
    or request_uri ilike '%/etc/shadow%'
    or request_uri ilike '%/etc/hosts%'
    or request_uri ilike '%/etc/fstab%'
    or request_uri ilike '%/etc/issue%'
    or request_uri ilike '%/etc/profile%'
    or request_uri ilike '%/etc/ssh%'
    or request_uri ilike '%/proc/version%'
    or request_uri ilike '%/proc/self%'
    or request_uri ilike '%/proc/cpuinfo%'
    or request_uri ilike '%/var/log/auth.log%'
    or request_uri ilike '%/var/log/secure%'
    -- Windows sensitive files
    or request_uri ilike '%c:\\windows\\win.ini%'
    or request_uri ilike '%c:\\boot.ini%'
    or request_uri ilike '%c:\\windows\\system32\\config%'
    or request_uri ilike '%c:\\windows\\repair%'
    or request_uri ilike '%c:\\windows\\debug\\netsetup.log%'
    or request_uri ilike '%c:\\windows\\iis%log%'
    or request_uri ilike '%c:\\sysprep.inf%'
    or request_uri ilike '%c:\\sysprep\\sysprep.xml%'
    -- Web server files
    or request_uri ilike '%/var/log/apache%'
    or request_uri ilike '%/var/log/httpd%'
    or request_uri ilike '%/usr/local/apache%'
    or request_uri ilike '%/usr/local/nginx%'
    or request_uri ilike '%/var/log/nginx%'
  )
order by
  tp_timestamp desc;