topic Re: alert on deleted data in Getting Data In

alert on deleted data

troywollenslege — Tue, 20 Mar 2012 20:39:36 GMT

Trying to look through the _internal logs in realtime to fire an alert if anyone tries to delete files with

| delete

All searches I try will find the search itself (thus always firing).

Thoughts?

Re: alert on deleted data

lguinn2 — Wed, 21 Mar 2012 05:17:42 GMT

In 4.3 -

You can do the realtime alert on a rolling window, which gives you the opportunity to set a custom condition. In the custom condition, test for _time != now()

"now" is the time that the search started...

I am not sure that this will work, but I think it should...

Re: alert on deleted data

troywollenslege — Wed, 21 Mar 2012 16:22:20 GMT

Maybe wasn't clear. I can do the search the problem is that when I search for someone deleting data, the search itself is found. So i woudl get alerted every time.

Re: alert on deleted data

araitz — Wed, 21 Mar 2012 17:36:23 GMT

Put a crazy string in your search, like so:

 index=_audit "action=search" search=*delete* NOT dfsdkljwkwtw

This will prevent your search from showing up in the results.

You might want to refine it a big using a regex to look for | delete, |delete, | delete, etc.

Re: alert on deleted data

troywollenslege — Wed, 21 Mar 2012 18:09:45 GMT

Thx. I was using _internal, audit seems to work better;

index=_audit "action=search" search="*delete'" | table user info search
This is the search that I am going to run, seems to work with the caviot that there may be some false positives, which I am ok with.

Re: alert on deleted data

awjohnson — Mon, 28 Sep 2020 16:13:45 GMT

This is the search I'm running to monitor for delete attempts:

index=_audit sourcetype=audittrail "|" "delete" NOT "search='search index=_audit"

I'm searching the index of _audit and the sourcetype of auditrail for | and delete. Then so that my searches for delete activity do not generate alerts, I exclude searches of searches that include delete.