Splunk linux

revanthammineni — Tue, 20 Oct 2020 04:53:33 GMT

Hi Splunkers!

I'm actually working on root privilege escalations with linux logs and I have limited experience with it. Can anyone please help me to give some knowledge over what Linux logs should I work on? and How I should proceed with it.

Thanks in advance.

Re: Splunk linux

gcusello — Tue, 20 Oct 2020 06:28:26 GMT

Hi @revanthammineni.

if you haven't a great knowledge of Linux Operative Systems and you don't know what logs to use, you could deploy on your Linux target systems the Splunk Add On for Unix and Linux (https://splunkbase.splunk.com/app/833/).

it contains all the inputs to take logs from Linux targets.

If you install it on a Splunk Server, you can enable inputs by GUI, if instead you use it on a Universal Forwarder, you have to manually enable inputs:

create the local folder in $SPLUNK_HOME/etc/apps/Splunk_TA_nix,
copying inputs.conf from default to local folder,
putting disable = 0 to all the stanza inputs,
restarting splunk on the forwarder.

This TA send logs to the default index (main), if you want to send logs to another index (usually "os"), you have to insert in every stanza of inputs.conf "index = os".

Ciao.

Giuseppe

topic Splunk linux in Security

Splunk linux

Re: Splunk linux