All Apps and Add-ons

Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

jgedeon120
Contributor

The current eventtype Failed_SU creates a large number of false positives for logs coming from /var/adm/sulog. The logs will always have a - between the src_user and the user. This is being picked up by the eventtype. To correct this, there needs to be spaces before and after the - between the quotes.

Current:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU "-") OR ("BAD SU ")

Updated:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Also, the following could be used for the log messages field extractions and then update the nix_vendor_actions lookup table with:
+, success
-, failure

I use the following for the them as a transform extraction

[aix_su]
REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5
1 Solution

jgedeon120
Contributor

Updated the eventtype in the app:

 [Failed_SU]
 search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Updated the nix_vendor_actions.csv file with

+,success
-,failure

Created the following transform extraction:

[aix_su]
 REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
 FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

In the linux_secure sourcetype added:

REPORT-aix_su = aix_su

View solution in original post

jgedeon120
Contributor

Updated the eventtype in the app:

 [Failed_SU]
 search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Updated the nix_vendor_actions.csv file with

+,success
-,failure

Created the following transform extraction:

[aix_su]
 REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
 FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

In the linux_secure sourcetype added:

REPORT-aix_su = aix_su

View solution in original post

ppablo
Community Manager
Community Manager

Hi @jgedeon120

Thanks for sharing your findings and solutions with the Splunk Community on Answers. Would you actually be able to post the solutions as a formal answer below and Accept it once you do? This will resolve the post as having an accepted answer and will make it easier for other users to find this as well.

Cheers

Patrick

0 Karma

jgedeon120
Contributor

Done. Hopefully some of this can get fixed in the app. I'm not sure how it's gone this long without being corrected. 🙂

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!