topic How can we track changes made in correlation searches? in Splunk Enterprise Security

How can we track changes made in correlation searches?

ManishVilla7 — Thu, 17 Nov 2022 16:32:59 GMT

I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved??

Please help.

Re: How can we track changes made in Correlation searches??

richgalloway — Wed, 16 Sep 2020 12:45:11 GMT

There's no good way to do that within Splunk. The audit logs may tell that someone touched a CS, but it won't say what changes were made.

Consider tracking your .conf files in a source management tool like git so you not only know when a change is made, but can revert to a previous instance if necessary.

Re: How can we track changes made in Correlation searches??

ManishVilla7 — Wed, 16 Sep 2020 12:50:38 GMT

@richgalloway can we at-least get the info of who made the change, search name, time. I am not tracking the exact change made but who all made the changes.

Re: How can we track changes made in Correlation searches??

richgalloway — Wed, 16 Sep 2020 15:29:24 GMT

Start with this query. Replace "<searchName>" with the URL-encoded name of the search you're interested in. Or use "saved/searches" for a generic search.

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

Re: How can we track changes made in Correlation searches??

Jhunter — Wed, 16 Sep 2020 23:12:25 GMT

Possibly use the rest command combined with Rich's internal search: (taken and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance.

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change.

Re: How can we track changes made in Correlation searches??

amitpanjawani — Thu, 03 Jun 2021 07:26:32 GMT

I was searching for the same, then i developed this app for the community. https://splunkbase.splunk.com/app/4144/

Re: How can we track changes made in Correlation searches??

wabesman_OG — Thu, 17 Nov 2022 16:29:10 GMT

Going through the audit logs I found this query helpful.

index=_audit action=create_saved_search actions=* app=* disabled=* info=* user=*
| table _time savedsearch user action actions app disabled info