topic How do I ensure the security of Splunk itself ? Tampering with Splunks's indexes, events, eventtypes, etc. ? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70751#M14403 <P>As a for instance, I logged in as an "admin" and clicked on "Disable" on an event type. I searched using index = _audit and index = _index with various search filters to no avail. I believe the indexes are secure but would like additional assurance there as well.</P> Thu, 21 Mar 2013 22:16:12 GMT USPSSplunkSuppo 2013-03-21T22:16:12Z How do I ensure the security of Splunk itself ? Tampering with Splunks's indexes, events, eventtypes, etc. ? https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70751#M14403 <P>As a for instance, I logged in as an "admin" and clicked on "Disable" on an event type. I searched using index = _audit and index = _index with various search filters to no avail. I believe the indexes are secure but would like additional assurance there as well.</P> Thu, 21 Mar 2013 22:16:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70751#M14403 USPSSplunkSuppo 2013-03-21T22:16:12Z Re: How do I ensure the security of Splunk itself ? Tampering with Splunks's indexes, events, eventtypes, etc. ? https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70752#M14404 <P>This section of the docs should prove helpful. <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Security/AuditSplunkactivity">http://docs.splunk.com/Documentation/Splunk/5.0.2/Security/AuditSplunkactivity</A></P> Thu, 21 Mar 2013 22:21:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70752#M14404 Ayn 2013-03-21T22:21:44Z Re: How do I ensure the security of Splunk itself ? Tampering with Splunks's indexes, events, eventtypes, etc. ? https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70753#M14405 <P>I have already been here. Note that I stated that using index = _audit and index = _index was not successful. Additionally the link under the "Activities that generate audit events" section that states "all files in Splunk's configuration directory $SPLUNK_HOME/etc/*<BR /> files are monitored for add/change/delete using the file system change monitor" directs the user to a page that states "Note: This feature has been deprecated in Splunk version 5.0."</P> Mon, 28 Sep 2020 13:34:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70753#M14405 USPSSplunkSuppo 2020-09-28T13:34:42Z Re: How do I ensure the security of Splunk itself ? Tampering with Splunks's indexes, events, eventtypes, etc. ? https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70754#M14406 <P>Yup, sadly the fschange functionality (that monitors changes to files and directories) has been deprecated. NOTE that this does NOT mean it's gone - it's just that development on it has stopped and it MIGHT be removed sometime in the future.</P> <P>Also you should check out not just that specific page I linked to, but the whole section shows you various ways of ensuring the integrity of your logs.</P> Fri, 22 Mar 2013 07:28:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-ensure-the-security-of-Splunk-itself-Tampering-with/m-p/70754#M14406 Ayn 2013-03-22T07:28:43Z