Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- How to create an alert if anyone makes changes in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to create an alert if anyone makes changes in my environment?
in my environment, there are four admins. now i want to create an alert if anyone did any changes on GUI or internal. HOW??? can anyone let me know? thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use Splunk's index="_audit" and user="admin". Based on action field you can identify various user activities.
Refer to Splunk How To video on Youtube for audit security: https://www.youtube.com/watch?v=Qv-34lKnI70
You can also refer to Splunk Documentation for Security: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Searchforauditevents
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i really thank you for your response. what is the term that i have to use for action who did modification.
i.e is it like action=change
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a similar question, if someone did any change to .conf files how to raise a alert.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are multiple actions that you would need to watch. In fact you might have to check your existing logs for such historical transactions.
For example action=add can be used to monitor files/configurations added. You should also use path to identify what kind of file and what location has the file been added. Like path=".xml" OR path=".html" will show a view added to any app.
Similarly for action=update or action=delete
action="change_authentication" monitors change in user authentication
There are several action="edit_*" which monitor specific Splunk component modification. For example, action="edit_view_html" will monitor changes to HTML views created in Splunk (used along with object=<HTML View Name>)
action="login attempt" along with info field will give number of login attempts with failed or successful information.
action="restart_splunkd" will capture details on who/when Splunk instance was restarted
action="search" and action="rtsearch" will give information on Splunk Historical and Real Time searches. You can identify which are the long running queries.
Essentially, you would need to identify and use the specific queries as per your needs.
| makeresults | eval message= "Happy Splunking!!!"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
