Deployment Architecture

Searching for failed file accesses from linux audit data

Path Finder

In my test environment I have several Windows and Linux systems using splunk forwarder to send audit logs to the main splunk server. We have a requirement to detect and investigate failed accesses to security-relevant objects (SROs), which is basically a list of files or directories that we specify. Detecting failed access to SROs with Windows audit events is relatively easy since that is a single event with a well-known event ID. However in Linux that raw audit data looks like 3 separate audit events with a common event id. I've started down the path of creating a custom search script and am able to read in the event data from splunk.Intersplunk.getOrganizedResults but I'm stuck at the point of generating an event to put into splunk.Intersplunk.outputResults. Is there a method to generate a new event (transient?) to return from my saved search?

0 Karma
1 Solution

Motivator

if the three separate audit events that make up the failed access always have the same structure or format, you can define a transaction to represent them, and then search for/alert on that instead:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttransactions
http://www.splunk.com/base/Documentation/latest/Knowledge/Definetransactions

i'm probably missing something, but i'm not sure that creating a custom search command is needed here.

View solution in original post

Motivator

if the three separate audit events that make up the failed access always have the same structure or format, you can define a transaction to represent them, and then search for/alert on that instead:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttransactions
http://www.splunk.com/base/Documentation/latest/Knowledge/Definetransactions

i'm probably missing something, but i'm not sure that creating a custom search command is needed here.

View solution in original post

Motivator

correct, you can use search-time field extractions to make this happen:
http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

0 Karma

Path Finder

Thanks for the reply. If my first read of the transaction documentation is correct it needs to key off of a common field in each of the events. What I look at when doing a manual review is a section that looks like:

audit([epoch_time].[milliseconds]:[audit_event])

where [audit_event] is the important part between the 3 lines of correlated audit data. Splunk currently doesn't see that as a field so I'll have to tell splunk that is important first, correct?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!