Query for Alert_identification

adm_rashi — Tue, 29 Sep 2020 23:56:06 GMT

Hello All,

I tried the below query and got the results as well but my concern is who is modifying, deleting or creating new alerts?

How can I search about existing alerts in my Splunk environment?

Thanks in advance!!

QUERY:
index=_internal sourcetype=splunkd_access
(method=POST OR method=DELETE)
(user!=splunk-system-user user!=-)
(uri_path=/servicesNS/* uri_path!="/user-prefs/" uri_path!="/servicesNS////jobs//control" uri_path!=/servicesNS//mobile_access )
| replace "/ui/views" with "/ui_views", "/props" with "*", "/distributed/peers*" with "/distributed_peers", "/server/serverclasses" with "/server_class" in uri_path
| where mvcount( split( uri_path , "/" ) ) > 6
| eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method="DELETE" , "Deleted" )
| rex field=uri_path "/servicesNS(/[^\/]+){3}/(?[^\/]+)/(?[^\/]+)"
| eval object_name = urldecode( object_name )
| table _time, user, object_name, object_type, activity|

topic Query for Alert_identification in Splunk Enterprise Security

Query for Alert_identification