AU-2 Audit events

[JIreland]

Hello,

Newb here trying to get up to speed...

I need to create dashboards that will allow me to perform the audit events listed in the JSIG:

1. Authentication events:
    (1) Logons (Success/Failure)
    (2) Logoffs (Success)
2. Security Relevant File and Objects events:
    (1) Create (Success/Failure)
    (2) Access (Success/Failure)
    (3) Delete (Success/Failure)
    (4) Modify (Success/Failure)
    (5) Permission Modification (Success/Failure)
    (6) Ownership Modification (Success/Failure)
3. Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure)
4. Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure)
5. User and Group Management events:
    (1) User add, delete, modify, disable, lock (Success/Failure)
    (2) Group/Role add, delete, modify (Success/Failure)
6. Use of Privileged/Special Rights events:
    (1) Security or audit policy changes (Success/Failure)
    (2) Configuration changes (Success/Failure)
7. Admin or root-level access (Success/Failure)
8. Privilege/Role escalation (Success/Failure)
9. Audit and security relevant log data accesses (Success/Failure)
10. System reboot, restart and shutdown (Success/Failure)
11. Print to a device (Success/Failure)
12. Print to a file (e.g., pdf format) (Success/Failure)
13. Application (e.g., Adobe, Firefox, MS Office Suite) initialization

Are there templated Splunk search commands for these? And if so, could you point me to them? Many thanks!

[isoutamo]

You probably have getting that data in with Splunk's Windos and *nix Add-ones? If not then I strongly recommend you to use those! With those you will get events as CIM compliant. That way it's much easier to look some other apps from splunk base which are using CIM to create those queries for you dashboard(s).

Here is some apps from splunkbase:

• https://splunkbase.splunk.com/app/4240
• https://splunkbase.splunk.com/app/1621
• https://splunkbase.splunk.com/app/742
• https://splunkbase.splunk.com/app/3757
• https://splunkbase.splunk.com/app/4882
• https://splunkbase.splunk.com/app/3786
• https://splunkbase.splunk.com/app/6722

Those are just order which I get from my SCP instance, not any preferred etc.

r. Ismo

[livehybrid]

Hi @JIreland 

This will entirely depend on the sourcetypes that you are feeding in to Splunk. What is the source of your Audit data?

There may be some pre-build dashboards for some of these in apps specific to the type of data you are bringing in. Otherwise it might be a case of working through the data to put together each of these.

When you are putting together the dashboards, bear in mind that sometimes things within dashboards can be missed or overlooked if crowded, and that things like alerts may be more suitable for rare events that you need to know about.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will