topic Re: Searching for failed file accesses from linux audit data in Deployment Architecture

Searching for failed file accesses from linux audit data

chadroberts — Thu, 21 Apr 2011 14:05:29 GMT

In my test environment I have several Windows and Linux systems using splunk forwarder to send audit logs to the main splunk server. We have a requirement to detect and investigate failed accesses to security-relevant objects (SROs), which is basically a list of files or directories that we specify. Detecting failed access to SROs with Windows audit events is relatively easy since that is a single event with a well-known event ID. However in Linux that raw audit data looks like 3 separate audit events with a common event id. I've started down the path of creating a custom search script and am able to read in the event data from splunk.Intersplunk.getOrganizedResults but I'm stuck at the point of generating an event to put into splunk.Intersplunk.outputResults. Is there a method to generate a new event (transient?) to return from my saved search?

Re: Searching for failed file accesses from linux audit data

piebob — Thu, 21 Apr 2011 14:51:55 GMT

if the three separate audit events that make up the failed access always have the same structure or format, you can define a transaction to represent them, and then search for/alert on that instead:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttransactions
http://www.splunk.com/base/Documentation/latest/Knowledge/Definetransactions

i'm probably missing something, but i'm not sure that creating a custom search command is needed here.

Re: Searching for failed file accesses from linux audit data

chadroberts — Mon, 28 Sep 2020 09:28:46 GMT

Thanks for the reply. If my first read of the transaction documentation is correct it needs to key off of a common field in each of the events. What I look at when doing a manual review is a section that looks like:

audit([epoch_time].[milliseconds]:[audit_event])

where [audit_event] is the important part between the 3 lines of correlated audit data. Splunk currently doesn't see that as a field so I'll have to tell splunk that is important first, correct?

Re: Searching for failed file accesses from linux audit data

piebob — Thu, 21 Apr 2011 22:59:38 GMT

correct, you can use search-time field extractions to make this happen:
http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles