Need help to identify user field in my current search string

jcorkey — Tue, 01 Aug 2017 17:27:42 GMT

Below is my search string:

index=* host=* sourcetype="*" "usermod" "add" "to shadow group" | rex "^(?:[^'\n]*'){3}(?P<addedToGroup>\w+)" | rex "^[^'\n]*'(?P<userInGroup>\w+)"

This search shows me which user was added to which group but I really need it to show WHO added the user to the group. I can't figure out how to find the actual user who ran the usermod command. What do I need to do to get that field?

Re: Need help to identify user field in my current search string

somesoni2 — Tue, 01 Aug 2017 18:10:24 GMT

Can you share a sample event? Do you know if the raw data contains who ran the command?

Re: Need help to identify user field in my current search string

DalJeanis — Tue, 01 Aug 2017 19:32:14 GMT

That's looking like unix log records. Your best bet is to take all the events from about 30 seconds before to ten seconds after and look at each one.

Here's a set of log records I stole for reference off of stackexchange ...

$ cat /var/log/auth.log | grep -i xyz
Dec 18 18:54:51 pandya-desktop sudo:   pandya : TTY=pts/2 ; PWD=/home/pandya ; USER=root ; COMMAND=/usr/sbin/useradd xyz
Dec 18 18:54:51 pandya-desktop useradd[7763]: new group: name=xyz, GID=1002
Dec 18 18:54:51 pandya-desktop useradd[7763]: new user: name=xyz, UID=1002, GID=1002, home=/home/xyz, shell=
Dec 18 18:55:51 pandya-desktop sudo:   pandya : TTY=pts/2 ; PWD=/home/pandya ; USER=root ; COMMAND=/usr/sbin/usermod -a -G group xyz
Dec 18 18:55:57 pandya-desktop sudo:   pandya : TTY=pts/2 ; PWD=/home/pandya ; USER=root ; COMMAND=/usr/sbin/usermod -a -G sudo xyz
Dec 18 18:55:57 pandya-desktop usermod[7872]: add 'xyz' to group 'sudo'
Dec 18 18:55:57 pandya-desktop usermod[7872]: add 'xyz' to shadow group 'sudo'

Your search is keying off the last record.

The immediately prior set of records indicate that the user involved in altering user xyz was USER=root. (Really helpful, right?)

The one other thing I noticed, poking around a bit, is that sometimes there will be a logoff right after the person does this. You might see something like "connection closed by 1.2.3.4" . So, that could be a clue too.

topic Re: Need help to identify user field in my current search string in Splunk Search

Need help to identify user field in my current search string

Re: Need help to identify user field in my current search string

Re: Need help to identify user field in my current search string