Alerting

How to alert on modifications made to user role and capability?

naqviah
Explorer

Hi,

I am trying to find a way for Splunk to alert on any modifications made to user roles/capabilities that state whether a user has gained access to "delete". I have tried the following REST, but it does not alert when a user gains the delete capability. Any help would be appreciated.

| rest services/authorization/roles | search capabilities=delete_by_keyword

lguinn2
Legend

This REST command does not show history, only the current point in time. So it is not a useful way to see when something happened in the past.

From another answer, @AndySplunks said "I have saved searches (and correlations) looking for any activity in _audit for object='can_delete' and for any search activity that includes '| delete'"

That is probably a better way to go.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this

| rest services/authorization/roles | where isnotnull(mvfind(match(capabilities,"delete_by_keyword")))
0 Karma

naqviah
Explorer

This returns the following error:

Error in 'where' command: The arguments to the 'mvfind' function are invalid.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Opps, wrong function and a type. Try this

| rest /services/authorization/roles | where isnotnull(mvfilter(match(capabilities,"delete_by_keyword")))
0 Karma

naqviah
Explorer

The results doesn't tell me which users have the "delete_by_keyword" capability. It just shows me which role has the capability in it.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this. This will give you list of users which have roles with delete capabilities.

| rest /services/authentication/users | table title roles | mvexpand roles 
| where [| rest /services/authorization/roles | where isnotnull(mvfilter(match(capabilities,"delete_by_keyword"))) | table title | rename title as roles] 
0 Karma

naqviah
Explorer

Thanks @somesoni2, but its generating 0 events, which i know is not true because there are number of users with delete_by_ capabilities.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

A place to start might be to make a request on the /users endpoint to look for users with this capability:

http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTaccess#authentication.2Fusers

There are a couple of additional suggestions/examples (including using an input to monitor a conf file for capability changes) in this related older thread that might help:
https://answers.splunk.com/answers/209323/can-splunk-searchalert-when-there-is-a-change-to-a.html

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...