Searching for failed file accesses from linux audit data

[chadroberts]

In my test environment I have several Windows and Linux systems using splunk forwarder to send audit logs to the main splunk server. We have a requirement to detect and investigate failed accesses to security-relevant objects (SROs), which is basically a list of files or directories that we specify. Detecting failed access to SROs with Windows audit events is relatively easy since that is a single event with a well-known event ID. However in Linux that raw audit data looks like 3 separate audit events with a common event id. I've started down the path of creating a custom search script and am able to read in the event data from splunk.Intersplunk.getOrganizedResults but I'm stuck at the point of generating an event to put into splunk.Intersplunk.outputResults. Is there a method to generate a new event (transient?) to return from my saved search?

[piebob · Accepted solution]

if the three separate audit events that make up the failed access always have the same structure or format, you can define a transaction to represent them, and then search for/alert on that instead:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttransactions
http://www.splunk.com/base/Documentation/latest/Knowledge/Definetransactions

i'm probably missing something, but i'm not sure that creating a custom search command is needed here.

[piebob]

correct, you can use search-time field extractions to make this happen:
http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

[chadroberts]

Thanks for the reply. If my first read of the transaction documentation is correct it needs to key off of a common field in each of the events. What I look at when doing a manual review is a section that looks like:

audit([epoch_time].[milliseconds]:[audit_event])

where [audit_event] is the important part between the 3 lines of correlated audit data. Splunk currently doesn't see that as a field so I'll have to tell splunk that is important first, correct?