Getting Data In

Splunk Self Monitoring

I_am_Jeff
Communicator

My security people have asked if there is a self-monitoring capability in Splunk to track situations such as

  • A disgruntled employee does something and tries to cover his track by
    modifying the log file and the Splunk index, either by editing or removal.
Tags (1)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

By default Splunk monitors changes to $SPLUNK_HOME/etc/. Changes to the index and log files are probably best tracked with operating system level changes. You could use fschange, but it is deprecated and as such, won't be around forever.

http://docs.splunk.com/Documentation/Splunk/latest/Data/FSChangelocal

However, in my opinion, operating system level tools(auditd) are preferable to something like fschange.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

By default Splunk monitors changes to $SPLUNK_HOME/etc/. Changes to the index and log files are probably best tracked with operating system level changes. You could use fschange, but it is deprecated and as such, won't be around forever.

http://docs.splunk.com/Documentation/Splunk/latest/Data/FSChangelocal

However, in my opinion, operating system level tools(auditd) are preferable to something like fschange.

I_am_Jeff
Communicator

HOWEVER, our security team did like event hashing.

http://docs.splunk.com/Documentation/Splunk/4.3.4/Admin/Eventhashing

0 Karma

I_am_Jeff
Communicator

Yup. I knew about fschange going away. And it's always difficult to have the watcher watch itself in a meaningful and trusted way. Thank you for your comments!

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...