Security

Audit modifications to a user account

tjohnston2
Splunk Employee
Splunk Employee

How do I tell when a user modifies another user and what they modified (ie added a role to the user)

Tags (2)

adamw
Communicator

I actually filed an enhancement request for this exact thing at the conference, but the more you file, the more attention it gets :). Also put in your business case when you put it in, it helps them know what it is used for.

0 Karma

Genti
Splunk Employee
Splunk Employee

Another thing you can try is use fschange on /splunkhome/etc/users/ directory. This way you could use the DIFF command for the files within to see what changed. I doubt you would be able to tell WHO changed it though.

So, by the first reply, you can possibly see who changed user privileges, and by the second one you can tracked what was changed.

I think this is as far as we can presently go with splunk.

0 Karma

Genti
Splunk Employee
Splunk Employee

See if this other thread helps you out: http://answers.splunk.com/questions/2286/search-for-deleted-splunk-users/3346#3346

Granted deleted vs modified is a bit different but im assuming it could be done in a similar way?

Genti
Splunk Employee
Splunk Employee

i think that is all the logs will be able to tell you. If you want more info you can file an enhancement request.

0 Karma

tjohnston2
Splunk Employee
Splunk Employee

Yes, this tells me that a particular user modified another user but it doesn't seem to tell me what was modified.

0 Karma

Dan
Splunk Employee
Splunk Employee

Yeah, probably a POST instead of DELETE to the endpoint

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...