topic How to create an alert if anyone makes changes in my environment? in Alerting

How to create an alert if anyone makes changes in my environment?

Rocky31 — Tue, 27 Dec 2016 05:00:25 GMT

in my environment, there are four admins. now i want to create an alert if anyone did any changes on GUI or internal. HOW??? can anyone let me know? thanks.

Re: How to create an alert if anyone makes changes in my environment?

niketn — Tue, 27 Dec 2016 06:57:30 GMT

You can use Splunk's index="_audit" and user="admin". Based on action field you can identify various user activities.

Refer to Splunk How To video on Youtube for audit security: https://www.youtube.com/watch?v=Qv-34lKnI70

You can also refer to Splunk Documentation for Security: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Searchforauditevents

Re: How to create an alert if anyone makes changes in my environment?

Rocky31 — Wed, 28 Dec 2016 13:21:01 GMT

i really thank you for your response. what is the term that i have to use for action who did modification.

i.e is it like action=change

Re: How to create an alert if anyone makes changes in my environment?

Rocky31 — Wed, 28 Dec 2016 17:31:00 GMT

I have a similar question, if someone did any change to .conf files how to raise a alert.

Re: How to create an alert if anyone makes changes in my environment?

niketn — Tue, 29 Sep 2020 12:13:48 GMT

There are multiple actions that you would need to watch. In fact you might have to check your existing logs for such historical transactions.

For example action=add can be used to monitor files/configurations added. You should also use path to identify what kind of file and what location has the file been added. Like path=".xml" OR path=".html" will show a view added to any app.

Similarly for action=update or action=delete

action="change_authentication" monitors change in user authentication

There are several action="edit_*" which monitor specific Splunk component modification. For example, action="edit_view_html" will monitor changes to HTML views created in Splunk (used along with object=<HTML View Name>)

action="login attempt" along with info field will give number of login attempts with failed or successful information.

action="restart_splunkd" will capture details on who/when Splunk instance was restarted

action="search" and action="rtsearch" will give information on Splunk Historical and Real Time searches. You can identify which are the long running queries.

Essentially, you would need to identify and use the specific queries as per your needs.