All Apps and Add-ons
Highlighted

Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

Contributor

The current eventtype FailedSU creates a large number of false positives for logs coming from /var/adm/sulog. The logs will always have a - between the srcuser and the user. This is being picked up by the eventtype. To correct this, there needs to be spaces before and after the - between the quotes.

Current:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU "-") OR ("BAD SU ")

Updated:

[Failed_SU]
search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Also, the following could be used for the log messages field extractions and then update the nixvendoractions lookup table with:
+, success
-, failure

I use the following for the them as a transform extraction

[aix_su]
REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5
Highlighted

Re: Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

Community Manager
Community Manager

Hi @jgedeon120

Thanks for sharing your findings and solutions with the Splunk Community on Answers. Would you actually be able to post the solutions as a formal answer below and Accept it once you do? This will resolve the post as having an accepted answer and will make it easier for other users to find this as well.

Cheers

Patrick

0 Karma
Highlighted

Re: Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

Contributor

Done. Hopefully some of this can get fixed in the app. I'm not sure how it's gone this long without being corrected. 🙂

0 Karma
Highlighted

Re: Splunk Add-on for Unix and Linux: False positives for eventtype Failed_SU and how to correct this

Contributor

Updated the eventtype in the app:

 [Failed_SU]
 search= (NOT sourcetype=stash) ("failed SU to another user" AND "Agent platform:" AND "linux-x86") OR ("failed SU to another user" AND "authentication failure" AND "for su service") OR ("failed SU to another user" AND logname=*) OR (exe="/bin/su" AND res="failed") OR (FAILED su for) OR (source="/var/adm/sulog" SU " - ") OR ("BAD SU ")

Updated the nixvendoractions.csv file with

+,success
-,failure

Created the following transform extraction:

[aix_su]
 REGEX = (SU) \d{2}\/\d{2} \d{2}:\d{2} ([\+|\-]) (\S+) (\S+)-(\S+)
 FORMAT = app::$1 vendor_action::$2 tty::$3 src_user::$4 user::$5

In the linux_secure sourcetype added:

REPORT-aix_su = aix_su

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.