Alerting

How to create an alert if anyone makes changes in my environment?

Path Finder

in my environment, there are four admins. now i want to create an alert if anyone did any changes on GUI or internal. HOW??? can anyone let me know? thanks.

0 Karma

SplunkTrust
SplunkTrust

You can use Splunk's index="_audit" and user="admin". Based on action field you can identify various user activities.

Refer to Splunk How To video on Youtube for audit security: https://www.youtube.com/watch?v=Qv-34lKnI70

You can also refer to Splunk Documentation for Security: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Searchforauditevents

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

i really thank you for your response. what is the term that i have to use for action who did modification.

i.e is it like action=change

0 Karma

Path Finder

I have a similar question, if someone did any change to .conf files how to raise a alert.

0 Karma

SplunkTrust
SplunkTrust

There are multiple actions that you would need to watch. In fact you might have to check your existing logs for such historical transactions.

For example action=add can be used to monitor files/configurations added. You should also use path to identify what kind of file and what location has the file been added. Like path=".xml" OR path=".html" will show a view added to any app.

Similarly for action=update or action=delete

action="change_authentication" monitors change in user authentication

There are several action="edit_*" which monitor specific Splunk component modification. For example, action="edit_view_html" will monitor changes to HTML views created in Splunk (used along with object=<HTML View Name>)

action="login attempt" along with info field will give number of login attempts with failed or successful information.

action="restart_splunkd" will capture details on who/when Splunk instance was restarted

action="search" and action="rtsearch" will give information on Splunk Historical and Real Time searches. You can identify which are the long running queries.

Essentially, you would need to identify and use the specific queries as per your needs.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma