My security people have asked if there is a self-monitoring capability in Splunk to track situations such as
By default Splunk monitors changes to $SPLUNK_HOME/etc/. Changes to the index and log files are probably best tracked with operating system level changes. You could use fschange, but it is deprecated and as such, won't be around forever.
http://docs.splunk.com/Documentation/Splunk/latest/Data/FSChangelocal
However, in my opinion, operating system level tools(auditd) are preferable to something like fschange.
By default Splunk monitors changes to $SPLUNK_HOME/etc/. Changes to the index and log files are probably best tracked with operating system level changes. You could use fschange, but it is deprecated and as such, won't be around forever.
http://docs.splunk.com/Documentation/Splunk/latest/Data/FSChangelocal
However, in my opinion, operating system level tools(auditd) are preferable to something like fschange.
HOWEVER, our security team did like event hashing.
http://docs.splunk.com/Documentation/Splunk/4.3.4/Admin/Eventhashing
Yup. I knew about fschange going away. And it's always difficult to have the watcher watch itself in a meaningful and trusted way. Thank you for your comments!