Security

Can Splunk audit logs be deleted by a user who has access to the Splunk server?

doncrittendon
Engager

Is it possible for a user who has access to the Splunk server delete audit logs in splunk? Auditors do not want our developers to have the ability to delete Splunk audit logs. But, our developers do have access to the Splunk server.

How can I prove to the auditors that the logs within Splunk cannot be deleted?

solarboyz1
Builder

If a user has r/w access to the Splunk indexers filesystems, they can modify the indexes.

If you want to prove the data had not been modified, I recommend checking out data integrity:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Dataintegritycontrol

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...