Getting Data In

alert on deleted data

troywollenslege
Path Finder

Trying to look through the _internal logs in realtime to fire an alert if anyone tries to delete files with | delete

All searches I try will find the search itself (thus always firing).

Thoughts?

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

Put a crazy string in your search, like so:

 index=_audit "action=search" search=*delete* NOT dfsdkljwkwtw

This will prevent your search from showing up in the results.

You might want to refine it a big using a regex to look for | delete, |delete, | delete, etc.

View solution in original post

awjohnson
Explorer

This is the search I'm running to monitor for delete attempts:

index=_audit sourcetype=audittrail "|" "delete" NOT "search='search index=_audit"

I'm searching the index of _audit and the sourcetype of auditrail for | and delete. Then so that my searches for delete activity do not generate alerts, I exclude searches of searches that include delete.

0 Karma

troywollenslege
Path Finder

Thx. I was using _internal, audit seems to work better;

index=_audit "action=search" search="*delete'" | table user info search
This is the search that I am going to run, seems to work with the caviot that there may be some false positives, which I am ok with.

0 Karma

araitz
Splunk Employee
Splunk Employee

Put a crazy string in your search, like so:

 index=_audit "action=search" search=*delete* NOT dfsdkljwkwtw

This will prevent your search from showing up in the results.

You might want to refine it a big using a regex to look for | delete, |delete, | delete, etc.

lguinn2
Legend

In 4.3 -

You can do the realtime alert on a rolling window, which gives you the opportunity to set a custom condition. In the custom condition, test for _time != now()

"now" is the time that the search started...

I am not sure that this will work, but I think it should...

0 Karma

troywollenslege
Path Finder

Maybe wasn't clear. I can do the search the problem is that when I search for someone deleting data, the search itself is found. So i woudl get alerted every time.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...