All Apps and Add-ons

Why is an ssh-login as root not tagged as "privileged" by the Unix-AddOn?


I can see, that events containing some app-data like su, sudo are the only ones the AddOn tags as privileged. But in my opinion a remote login via ssh as root should also be tagged as privileged - i.e. by default (of course, I know i can do it myself, but as this app is somehow "the official way to bring Unix/Linux data into Splunk", this should be already done).

What is the dev's opinion?

0 Karma


I would also tag any system that can have a remote login via ssh as root as "insecure by design." Or at least as having a broken audit trail. 🙂

Otherwise, I - though I have nothing to do with this add on - would agree with you it should be.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...