Security

How to audit capability assignment?

Contributor

Hi,

I am looking for real-time events from the aufit trail for capability assignments/changes, but it looks like this is not provided in audit.
How can I get an alert when someone adds can
delete for example? Or changes roles in other ways.
I know I can query the REST API for the current state, but I am more interested in getting alerts for changes.

Moitoring file changes also will only tell me that user X modifed authorize.conf, but not what was changed.

thx
afx

0 Karma

Contributor

The links posted do not anser the question (apart from implying NOT POSSIBLE).
As I wrote above, I am looking for a realtime information, so the rest API is useless as it leaves an unmonitored window.
And the audit log still does not provide the information needed, as it only notes a change, but not what was changed. Querying _audit for can_delete after I assigned the role shows nothing, so the information is not available in the audit log at all.

cheers
afx

0 Karma

SplunkTrust
SplunkTrust
0 Karma