Security

Can Splunk audit logs be deleted by a user who has access to the Splunk server?

doncrittendon
Engager

Is it possible for a user who has access to the Splunk server delete audit logs in splunk? Auditors do not want our developers to have the ability to delete Splunk audit logs. But, our developers do have access to the Splunk server.

How can I prove to the auditors that the logs within Splunk cannot be deleted?

solarboyz1
Builder

If a user has r/w access to the Splunk indexers filesystems, they can modify the indexes.

If you want to prove the data had not been modified, I recommend checking out data integrity:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Dataintegritycontrol

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...