Hi There,
I think the tricky bit will be setting something up to look within the file. Just to throw another option out there we have a system called LANGuardian which uses network traffic as a data source (SPAN\Mirror port or promcious mode on a vSwitch). It can extract metadata from the traffic so that you can see who is accessing what file on the network. It integrates with Orion and you can see an example of this on our demo
demo2.netfort.com/Orion/SummaryView.aspx?viewid=35&AccountID=guest
The next thing is to search within files. I ran a quick test and took a look at the results in Wireshark. The image below shows the packet which had the string I was looking for which was contained within a text file. It would also be possible with LANGuardian to set up an alert when this happened. It has a IDS module which can alert based on packet contents. Some customers use this to watch out for things like HOWDECRYPT.txt which is associated with those recent ransomware scares.
You may be able to do this with other tools so long as they had a way of searching within files or searching for certain metadata within network traffic.
Hope this helps,
Darragh
