All Apps and Add-ons

How to create a search that will show me any and all changes an admin made to firewalls?

theSOCguy
Explorer

Hello World, 

I am attempting to create a search in Splunk that will provide me with any and all changes an admin made to our firewalls. This is part of a "governance" task and we have logs coming from the FWs. Any pointers will be appreciated. 

Best,

AD

Labels (1)
Tags (2)
0 Karma

theSOCguy
Explorer

Been a while. Learning a lot about Splunk. I found the index and specific event code needed to make this search happen. 

index=fgt eventtype=ftnt_fortigate_config_change

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do the events that you have coming in look like? For example, fields you have extracted from the events, or do you need help extracting the fields?

theSOCguy
Explorer

@ITWhisperer I'm sitting down with the people that configured Splunk for this network. I cant even get basic logs to pull-up via a simple search. Might be a configuration issue. I will get back to you once I have some logs to work with. 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...