topic Re: Monitor Role Changes in _Audit Trail in Security

Monitor Role Changes in _Audit Trail

lathwal — Mon, 06 Nov 2017 18:32:34 GMT

Audit:[timestamp=10-29-2017 15:55:70.674, user=bob@bob.com, action=edit_user, info=granted object="jerry@jerry.com" operation=edit][n/a]

Is there anyway to actually see the edits that Bob made to Jerry's user account. Specifically what roles were added or removed.

Tried to use,

| rest /services/authentication/current-context splunk_server=local

but that only provides the roles that my current account has. Any help would be appreciated/

valiquet — Wed, 24 Apr 2019 06:29:24 GMT

You need to run with higher privilege. for REST.

dstaulcu — Thu, 17 Oct 2019 23:41:37 GMT

Seems odd to me, too, that that the event in the audit index do not describe the nature of the role change.