Security

Can Splunk audit logs be deleted by a user who has access to the Splunk server?

doncrittendon
Engager

Is it possible for a user who has access to the Splunk server delete audit logs in splunk? Auditors do not want our developers to have the ability to delete Splunk audit logs. But, our developers do have access to the Splunk server.

How can I prove to the auditors that the logs within Splunk cannot be deleted?

solarboyz1
Builder

If a user has r/w access to the Splunk indexers filesystems, they can modify the indexes.

If you want to prove the data had not been modified, I recommend checking out data integrity:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Dataintegritycontrol

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...