Security

How to query to monitor new inputs

sarit_s
Communicator

Hello

I want to monitor if user run new search in our environment or created new alert 
i tried to use this query :

 

|rest /services/saved/searches | search action.email.to=* OR action.email.to=*  | where  disabled=0  | table title , search , updated

 

the problem is that there is no time field in order to compare the 'updated' value with time to know if there is something new.

is there any other way to check new entries ?

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The updated field gives you the time it was updated - can you compare that to now()?

0 Karma

sarit_s
Communicator

does 

|rest /services/saved/searches

returns only saved searches or also real time searches ?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that you should use REST Endpoint 

| rest /servicesNS/-/-/saved/searches 

to get all users saved searches from all apps. With your original you didn't get those.

I think that you get only alerts/reports etc. which are stored into savedsearches.conf not those which users are currently running as add hoc. But best to check it unless someone can confirm this.

To check if there are any new savedsearches which has modified you must generate lookup where you stored those modified times and then check if that differs now.

r. Ismo

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Tom West does a good presentation on Dashboarding Wowzas at BSides (BSides Splunk Conference) and other places where he presents version control for dashboards. This could easily be modified to deal with searches.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...