Security

Can Splunk audit logs be deleted by a user who has access to the Splunk server?

doncrittendon
Engager

Is it possible for a user who has access to the Splunk server delete audit logs in splunk? Auditors do not want our developers to have the ability to delete Splunk audit logs. But, our developers do have access to the Splunk server.

How can I prove to the auditors that the logs within Splunk cannot be deleted?

solarboyz1
Builder

If a user has r/w access to the Splunk indexers filesystems, they can modify the indexes.

If you want to prove the data had not been modified, I recommend checking out data integrity:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Dataintegritycontrol

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...