https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277541#M83684 <P>Hi guys,</P> <P>I'm trying to monitor command execution over certain directories in linux. To do that, I've made a report that displays that data in a table format, something like this...</P> <PRE><CODE>USER COMMAND PWD _time usr1 cat /opt time1 usr2 less /example1 time2 usr3 visudo /example2 time3 </CODE></PRE> <P>But now, I wan't something more complex. I've created a whitelist (CSV file) with user, allowedCommands, directory(PWD) to alert not only when a user outside this whitelist is executing something, but also whitelisted users outside their allowed commands by directory.</P> <P>I've been playing with lookups/inputlookups, but I couldn't make it work.</P> <P>Any ideas ? </P> <P>KR.</P> Tue, 20 Oct 2015 18:41:58 GMT alemarzu 2015-10-20T18:41:58Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277541#M83684 <P>Hi guys,</P> <P>I'm trying to monitor command execution over certain directories in linux. To do that, I've made a report that displays that data in a table format, something like this...</P> <PRE><CODE>USER COMMAND PWD _time usr1 cat /opt time1 usr2 less /example1 time2 usr3 visudo /example2 time3 </CODE></PRE> <P>But now, I wan't something more complex. I've created a whitelist (CSV file) with user, allowedCommands, directory(PWD) to alert not only when a user outside this whitelist is executing something, but also whitelisted users outside their allowed commands by directory.</P> <P>I've been playing with lookups/inputlookups, but I couldn't make it work.</P> <P>Any ideas ? </P> <P>KR.</P> Tue, 20 Oct 2015 18:41:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277541#M83684 alemarzu 2015-10-20T18:41:58Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277542#M83685 <P>Try something like this</P> <P>Step1: Add a field, say flag="Y" in your whitelist lookup file. This will used as return value for matches.<BR /> Step2: update your search like this</P> <PRE><CODE>Your current search giving table with fields USER COMMAND PWD _time | lookup YourWhitelistTable user as USER allowedCommands as COMMAND OUTPUT flag as commandFlag | lookup YourWhitelistTable user as USER directory as PWD OUTPUT flag as pwdFlag | where commandFlag!="Y" OR pwdFlag!="Y" </CODE></PRE> Tue, 20 Oct 2015 19:02:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277542#M83685 somesoni2 2015-10-20T19:02:33Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277543#M83686 <P>It's working! </P> <P>Any idea why "commandFlag" field ends up with more than one "Y" per event in some cases?</P> <P>Thx mate.</P> Fri, 23 Oct 2015 15:04:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-command-execution-over-pwd-by-users-in-Linux/m-p/277543#M83686 alemarzu 2015-10-23T15:04:22Z