We have a request to generate a notable event in Splunk ES for any changes made in the linux OS to /etc/passwd and groups
Does ES have a built in search to detect such a change?
I have no desire to re-invent the wheel
That would be reliant on you having data that comes into Splunk that indicates file changes. A good place to start is OSQuery. You can use that to collect such data. Then map the data to the Common Information Model and then make your desired correlation search on that. The old fschange input type in Splunk has been deprecated for a long time so you shouldn't rely on it.