Monitoring Splunk

How to audit changes in Splunk objects (Git or else)?

evelenke
Contributor

Hi Splunkers,

we need to monitor who, when, where and what was changed in macros, searches and so on.

Internal index can answer to "who, when, where" (audit POST requests). 

Which is the right and preferred way to answer to "what" exactly was added or removed to/from the knowledge object during the change operation.

P.S. We have to have this information in Splunk and correlate with _internal audit

Labels (2)
0 Karma

jcaceres
Explorer

Take a look at Splunk Ideas E-I-49  and upvote. I think that aligns with what you're looking for. 

0 Karma

shivanshu1593
Builder

You may want to look into this, as it looks somewhat similar to your requirements. Mind you, there are going to be a lot of false positives.

How to audit changes in savedsearches.conf 

Hope this helps,

S

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

evelenke
Contributor

Hi,

so you say "_audit index is your friend for this" , but in the answer you'd proposed me the very first sentence is "It's already been determined that alarms/reports modifications are not being audited in _audit and _internal indexes." . 🙂

Thanks anyway!

0 Karma

shivanshu1593
Builder

Ah my bad. First started  with the audit index, then remembered that a thread is already there for the issue. Totally forgot to edit the post after pasting the link.

Thanks for pointing out, man 😄

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...