Knowledge Management

Best type of event hashing

imacdonald2
Path Finder

I am looking for the best way to keep an auditor happy that no one has tampered with system event logs, either windows or linux, so if someone went in and changed or deleted the events from an index then we can tell. From my first read it sounds like IT hashes might be the best way. Does anyone have any suggestions or experience.

Tags (1)
0 Karma

jbsplunk
Splunk Employee
Splunk Employee

The answer should be that if you're able to show the auditor some type of hashing that logs changes to files which you're interested in seeing, the requirement is satisfied. That is the approach I have always seen in the past. If an auditor feels that a particular type of auditing is insufficient, they should be able to articulate to you what they'd find to be sufficient, and why the method you're using is faulty. Having worked on different types of compliance standards in the past, in my experience this can vary greatly from organization to organization, or even from different auditors within the same organization.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...