topic Re: Can Splunk read inside a file and filter based on a word inside? in Splunk Search

Can Splunk read inside a file and filter based on a word inside?

NizanCohen — Mon, 11 Jul 2022 13:58:30 GMT

Hi all.

I want to create an alert for hosts file modification.

Found the build in one here on the forums but I would like to add a filter that can read inside the file and when it's being modified by Docker, it would ignore and won't activate the alert.

Appreciate the assistance!

Re: Can Splunk read inside a file and filter based on a word inside?

richgalloway — Mon, 11 Jul 2022 17:17:15 GMT

I'm not aware of anything tells Splunk *who* is modifying a file. Splunk just gets the new data immediately after it is written.

If there is something in the data itself that says it was written by Docker then you could recognize that and send the line to the null queue.

Re: Can Splunk read inside a file and filter based on a word inside?

yuanliu — Mon, 11 Jul 2022 18:55:06 GMT

@richgalloway I think the idea is for Docker to leave a mark (e.g., a comment) in /etc/hosts to indicate that it intentionally modified the file. But without information about how the original alert is set up, all we can say is "yes, it is possible," even though a plausible implementation could be cumbersome.

Additionally, using marker in hosts file itself leaves the file open to malicious attacks. Another possible way to suppress a given alert on condition is to design a separate message path from Docker into Splunk. All these are doable. The question is how much effort.

Re: Can Splunk read inside a file and filter based on a word inside?

NizanCohen — Mon, 11 Jul 2022 19:24:00 GMT

I don't need to know who modified it but to filter out all Docker's updates (which are automatic).

https://research.splunk.com/deprecated/windows_hosts_file_modification/

^that's the alert I currently using for that.

I would like to filter out Docker so when there is a machine with Docker related update, it won't alert me.

Re: Can Splunk read inside a file and filter based on a word inside?

yuanliu — Mon, 11 Jul 2022 21:33:42 GMT

I don't need to know who modified it but to filter out all Docker's updates (which are automatic).

@NizanCohen that is exactly what richgalloway points out: How does Splunk (or anybody/anything, for that matter) know?

If you know of a signal to tell whether there is a Docker related update in events that your Splunk receives, there is always a way to do it.