In my test environment I have several Windows and Linux systems using splunk forwarder to send audit logs to the main splunk server. We have a requirement to detect and investigate failed accesses to security-relevant objects (SROs), which is basically a list of files or directories that we specify. Detecting failed access to SROs with Windows audit events is relatively easy since that is a single event with a well-known event ID. However in Linux that raw audit data looks like 3 separate audit events with a common event id. I've started down the path of creating a custom search script and am able to read in the event data from splunk.Intersplunk.getOrganizedResults but I'm stuck at the point of generating an event to put into splunk.Intersplunk.outputResults. Is there a method to generate a new event (transient?) to return from my saved search?
if the three separate audit events that make up the failed access always have the same structure or format, you can define a transaction to represent them, and then search for/alert on that instead:
http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttransactions
http://www.splunk.com/base/Documentation/latest/Knowledge/Definetransactions
i'm probably missing something, but i'm not sure that creating a custom search command is needed here.
if the three separate audit events that make up the failed access always have the same structure or format, you can define a transaction to represent them, and then search for/alert on that instead:
http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttransactions
http://www.splunk.com/base/Documentation/latest/Knowledge/Definetransactions
i'm probably missing something, but i'm not sure that creating a custom search command is needed here.
correct, you can use search-time field extractions to make this happen:
http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...
Thanks for the reply. If my first read of the transaction documentation is correct it needs to key off of a common field in each of the events. What I look at when doing a manual review is a section that looks like:
audit([epoch_time].[milliseconds]:[audit_event])
where [audit_event] is the important part between the 3 lines of correlated audit data. Splunk currently doesn't see that as a field so I'll have to tell splunk that is important first, correct?