All Apps and Add-ons

Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

jgedeon120
Contributor

The current eventtype Failed_SU creates a large number of false positives for logs coming from /var/adm/sulog. The logs will always have a - between the src_user and the user. This is being picked up by the eventtype. To correct this, there needs to be spaces before and after the - between the quotes.

Current:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU "-") OR ("BAD SU ")

Updated:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Also, the following could be used for the log messages field extractions and then update the nix_vendor_actions lookup table with:
+, success
-, failure

I use the following for the them as a transform extraction

[aix_su]
REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5
1 Solution

jgedeon120
Contributor

Updated the eventtype in the app:

 [Failed_SU]
 search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Updated the nix_vendor_actions.csv file with

+,success
-,failure

Created the following transform extraction:

[aix_su]
 REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
 FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

In the linux_secure sourcetype added:

REPORT-aix_su = aix_su

View solution in original post

jgedeon120
Contributor

Updated the eventtype in the app:

 [Failed_SU]
 search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Updated the nix_vendor_actions.csv file with

+,success
-,failure

Created the following transform extraction:

[aix_su]
 REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
 FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

In the linux_secure sourcetype added:

REPORT-aix_su = aix_su

ppablo
Retired

Hi @jgedeon120

Thanks for sharing your findings and solutions with the Splunk Community on Answers. Would you actually be able to post the solutions as a formal answer below and Accept it once you do? This will resolve the post as having an accepted answer and will make it easier for other users to find this as well.

Cheers

Patrick

0 Karma

jgedeon120
Contributor

Done. Hopefully some of this can get fixed in the app. I'm not sure how it's gone this long without being corrected. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...