https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353966#M166516 <P>That would be reliant on you having data that comes into Splunk that indicates file changes. A good place to start is OSQuery. You can use that to collect such data. Then map the data to the Common Information Model and then make your desired correlation search on that. The old fschange input type in Splunk has been deprecated for a long time so you shouldn't rely on it.</P> <UL> <LI><A href="https://code.facebook.com/posts/844436395567983/introducing-osquery/">https://code.facebook.com/posts/844436395567983/introducing-osquery/</A></LI> <LI><A href="http://docs.splunk.com/Documentation/CIM/4.8.0/User/ChangeAnalysis">http://docs.splunk.com/Documentation/CIM/4.8.0/User/ChangeAnalysis</A></LI> </UL> Tue, 08 Aug 2017 16:33:20 GMT starcher 2017-08-08T16:33:20Z https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353965#M166515 <P>Hi All<BR /> We have a request to generate a notable event in Splunk ES for any changes made in the linux OS to /etc/passwd and groups<BR /> Does ES have a built in search to detect such a change?<BR /> I have no desire to re-invent the wheel</P> Tue, 08 Aug 2017 03:18:24 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353965#M166515 proylea 2017-08-08T03:18:24Z https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353966#M166516 <P>That would be reliant on you having data that comes into Splunk that indicates file changes. A good place to start is OSQuery. You can use that to collect such data. Then map the data to the Common Information Model and then make your desired correlation search on that. The old fschange input type in Splunk has been deprecated for a long time so you shouldn't rely on it.</P> <UL> <LI><A href="https://code.facebook.com/posts/844436395567983/introducing-osquery/">https://code.facebook.com/posts/844436395567983/introducing-osquery/</A></LI> <LI><A href="http://docs.splunk.com/Documentation/CIM/4.8.0/User/ChangeAnalysis">http://docs.splunk.com/Documentation/CIM/4.8.0/User/ChangeAnalysis</A></LI> </UL> Tue, 08 Aug 2017 16:33:20 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353966#M166516 starcher 2017-08-08T16:33:20Z https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353967#M166517 <P>The data input is done and normalised, I guess my question is what will ES do with that information out of the box?</P> <P>Do I need to write the correlation search or does ES already have one that covers this security scenario?</P> <P>ie. will ES generate a notable based on that input and changes to passwd and groups files? </P> <P>Is there an inbuilt ES correlation that just needs to be turned on?</P> Wed, 09 Aug 2017 00:26:18 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-ES-detecting-changes-to-OS-auth-files/m-p/353967#M166517 proylea 2017-08-09T00:26:18Z