Alerting

How to alert on modifications made to user role and capability?

naqviah
Explorer

Hi,

I am trying to find a way for Splunk to alert on any modifications made to user roles/capabilities that state whether a user has gained access to "delete". I have tried the following REST, but it does not alert when a user gains the delete capability. Any help would be appreciated.

| rest services/authorization/roles | search capabilities=delete_by_keyword

lguinn2
Legend

This REST command does not show history, only the current point in time. So it is not a useful way to see when something happened in the past.

From another answer, @AndySplunks said "I have saved searches (and correlations) looking for any activity in _audit for object='can_delete' and for any search activity that includes '| delete'"

That is probably a better way to go.

0 Karma

somesoni2
Revered Legend

How about this

| rest services/authorization/roles | where isnotnull(mvfind(match(capabilities,"delete_by_keyword")))
0 Karma

naqviah
Explorer

This returns the following error:

Error in 'where' command: The arguments to the 'mvfind' function are invalid.

0 Karma

somesoni2
Revered Legend

Opps, wrong function and a type. Try this

| rest /services/authorization/roles | where isnotnull(mvfilter(match(capabilities,"delete_by_keyword")))
0 Karma

naqviah
Explorer

The results doesn't tell me which users have the "delete_by_keyword" capability. It just shows me which role has the capability in it.

0 Karma

somesoni2
Revered Legend

Try this. This will give you list of users which have roles with delete capabilities.

| rest /services/authentication/users | table title roles | mvexpand roles 
| where [| rest /services/authorization/roles | where isnotnull(mvfilter(match(capabilities,"delete_by_keyword"))) | table title | rename title as roles] 
0 Karma

naqviah
Explorer

Thanks @somesoni2, but its generating 0 events, which i know is not true because there are number of users with delete_by_ capabilities.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

A place to start might be to make a request on the /users endpoint to look for users with this capability:

http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTaccess#authentication.2Fusers

There are a couple of additional suggestions/examples (including using an input to monitor a conf file for capability changes) in this related older thread that might help:
https://answers.splunk.com/answers/209323/can-splunk-searchalert-when-there-is-a-change-to-a.html

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...