Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

[jgedeon120]

The current eventtype Failed_SU creates a large number of false positives for logs coming from /var/adm/sulog. The logs will always have a - between the src_user and the user. This is being picked up by the eventtype. To correct this, there needs to be spaces before and after the - between the quotes.

Current:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU "-") OR ("BAD SU ")

Updated:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Also, the following could be used for the log messages field extractions and then update the nix_vendor_actions lookup table with:
+, success
-, failure

I use the following for the them as a transform extraction

[aix_su]
REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

[jgedeon120 · Accepted solution]

Updated the eventtype in the app:

 [Failed_SU]
 search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Updated the nix_vendor_actions.csv file with

+,success
-,failure

Created the following transform extraction:

[aix_su]
 REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
 FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

In the linux_secure sourcetype added:

REPORT-aix_su = aix_su

[ppablo]

Hi @jgedeon120

Thanks for sharing your findings and solutions with the Splunk Community on Answers. Would you actually be able to post the solutions as a formal answer below and Accept it once you do? This will resolve the post as having an accepted answer and will make it easier for other users to find this as well.

Cheers

Patrick

[jgedeon120]

Done. Hopefully some of this can get fixed in the app. I'm not sure how it's gone this long without being corrected. 🙂