in my environment, there are four admins. now i want to create an alert if anyone did any changes on GUI or internal. HOW??? can anyone let me know? thanks.
You can use Splunk's index="_audit" and user="admin". Based on action field you can identify various user activities.
Refer to Splunk How To video on Youtube for audit security: https://www.youtube.com/watch?v=Qv-34lKnI70
You can also refer to Splunk Documentation for Security: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Searchforauditevents
i really thank you for your response. what is the term that i have to use for action who did modification.
i.e is it like action=change
I have a similar question, if someone did any change to .conf files how to raise a alert.
There are multiple actions that you would need to watch. In fact you might have to check your existing logs for such historical transactions.
For example action=add can be used to monitor files/configurations added. You should also use path to identify what kind of file and what location has the file been added. Like path=".xml" OR path=".html" will show a view added to any app.
Similarly for action=update or action=delete
action="change_authentication" monitors change in user authentication
There are several action="edit_*" which monitor specific Splunk component modification. For example, action="edit_view_html" will monitor changes to HTML views created in Splunk (used along with object=<HTML View Name>)
action="login attempt" along with info field will give number of login attempts with failed or successful information.
action="restart_splunkd" will capture details on who/when Splunk instance was restarted
action="search" and action="rtsearch" will give information on Splunk Historical and Real Time searches. You can identify which are the long running queries.
Essentially, you would need to identify and use the specific queries as per your needs.