topic Re: Query Help in Alerting

Query Help

jasonballard — Tue, 24 Nov 2020 22:47:39 GMT

I have been tasked with writing Queries for the following and I am not sure how to go about it:

Detection / Event Name	Event Description
Master Password Use	The master password used to access the backend vault was used
Backend Vault Built in Admin Use	The built-in admin account on the backend vault was used
Sssd.conf modified on linux server	The sssd.conf file was modified on a linux server

Re: Query Help

ITWhisperer — Tue, 24 Nov 2020 23:19:22 GMT

What data do you have regarding these events?

Re: Query Help

jasonballard — Tue, 24 Nov 2020 23:20:24 GMT

I was told to base them on "Privileged Access Management (PAM) logs"

Re: Query Help

ITWhisperer — Tue, 24 Nov 2020 23:21:54 GMT

Are those logs already in splunk? Can you provide some sample events?

Re: Query Help

jasonballard — Tue, 24 Nov 2020 23:29:39 GMT

LIke this?

| `tstats` count from datamodel=Authentication.Authentication by _time,Authentication.action span=10m | timechart minspan=10m useother=`useother` count by Authentication.action | `drop_dm_object_name("Authentication")`

Re: Query Help

ITWhisperer — Tue, 24 Nov 2020 23:35:43 GMT

Does any of this data represent the events you are looking for?

Re: Query Help

jasonballard — Tue, 24 Nov 2020 23:41:25 GMT

To be honest, I am not sure where to start on this. This is my second week in this role.

The email from my boss said "If you have the cycles, below there are a list of use cases for creating alerts based on Privileged Access Management (PAM) logs. Could you give it a go today and tomorrow to see if you can leverage Splunk to find queries that can be used as correlative rules to detect these use cases?

Detection / Event Name	Event Description
Master Password Use	The master password used to access the backend vault was used
Backend Vault Built in Admin Use	The built-in admin account on the backend vault was used
Sssd.conf modified on linux server	The sssd.conf file was modified on a linux server

Re: Query Help

to4kawa — Wed, 25 Nov 2020 00:00:11 GMT

First, you need to check which logs and source types are supported for each item.

Can you present here a sample of the corresponding logs in case of detection?

I've never done it before.
Can you tell by looking at /var/log/sssd/sssd_pam.log?

Re: Query Help

jasonballard — Wed, 25 Nov 2020 19:57:48 GMT

So for the Master Password use, I think I could check the palog. if I go to C:\users\administrator\roaming\cyberark\privateark and check palog, I see entries like: "user master is working with vault prod with x records per send"

As for the Backend Vault Built in Admin Use. That may be something we need to configure the Safe to send out notifications on use and you can trigger off of that email that is sent out.

for sssd.conf, (this is the one I know the least about) I am thinking I need to reach out to our unix/linux group and see if they have any monitoring on those files, and if they do not, we may be able to set something up like the solution for the backend vault built in admin use to send out an email when cyberark changes it. (But I am not 100% on this one.)

Re: Query Help

to4kawa — Thu, 26 Nov 2020 09:55:02 GMT

If a characteristic term appears in the log, you can just search for it.
e.g. "user master is working "
Now you can also search the output results.
e.g. send out notifications

It is possible to make a query if you have a sample of the log and a description of the source type, etc.