https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-modify-an-indexed-event/m-p/206165#M7817 <P>Is it possible to modify an indexed event? My company is using Splunk for detecting suspicious activities. One of the scenarios is to detect Failed Logons to servers. I am afraid that someone (e.g. attacker) can modify the timestamp, username, or even delete the whole log to cover his/her track. Anyone know about this?</P> <P>Any white paper or official document has been released regarding to the above question?</P> <P>Thanks in advance!</P> Fri, 10 Jun 2016 07:25:59 GMT charlescywong 2016-06-10T07:25:59Z https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-modify-an-indexed-event/m-p/206165#M7817 <P>Is it possible to modify an indexed event? My company is using Splunk for detecting suspicious activities. One of the scenarios is to detect Failed Logons to servers. I am afraid that someone (e.g. attacker) can modify the timestamp, username, or even delete the whole log to cover his/her track. Anyone know about this?</P> <P>Any white paper or official document has been released regarding to the above question?</P> <P>Thanks in advance!</P> Fri, 10 Jun 2016 07:25:59 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-modify-an-indexed-event/m-p/206165#M7817 charlescywong 2016-06-10T07:25:59Z https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-modify-an-indexed-event/m-p/206166#M7818 <P>Data indexed in Splunk cannot be changed. That doesn't mean the source log can't be modified before it is indexed, however.<BR /> It's possible to delete data in Splunk (it's actually just marked as "invisible") by someone with the 'can_delete' privilege, but that's easily avoided by not granting the privilege to anyone.</P> Fri, 10 Jun 2016 12:36:04 GMT https://community.splunk.com/t5/Knowledge-Management/Is-it-possible-to-modify-an-indexed-event/m-p/206166#M7818 richgalloway 2016-06-10T12:36:04Z