Security

Splunk linux

revanthammineni
Path Finder

Hi Splunkers!

I'm actually working on root privilege escalations with linux logs and I have limited experience with it. Can anyone please help me to give some knowledge over what Linux logs should I work on? and How I should proceed with it.

Thanks in advance.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @revanthammineni.

if you haven't a great knowledge of Linux Operative Systems and you don't know what logs to use, you could deploy on your Linux target systems the Splunk Add On for Unix and Linux (https://splunkbase.splunk.com/app/833/).

it contains all the inputs to take logs from Linux targets.

If you install it on a Splunk Server, you can enable inputs by GUI, if instead you use it on a Universal Forwarder, you have to manually enable inputs:

  • create the local folder in $SPLUNK_HOME/etc/apps/Splunk_TA_nix,
  • copying inputs.conf from default to local folder,
  • putting disable = 0 to all the stanza inputs,
  • restarting splunk on the forwarder.

This TA send logs to the default index (main), if you want to send logs to another index (usually "os"), you have to insert in every stanza of inputs.conf "index = os".

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...