Splunk linux

[revanthammineni]

Hi Splunkers!

I'm actually working on root privilege escalations with linux logs and I have limited experience with it. Can anyone please help me to give some knowledge over what Linux logs should I work on? and How I should proceed with it.

Thanks in advance.

[gcusello]

Hi @revanthammineni.

if you haven't a great knowledge of Linux Operative Systems and you don't know what logs to use, you could deploy on your Linux target systems the Splunk Add On for Unix and Linux (https://splunkbase.splunk.com/app/833/).

it contains all the inputs to take logs from Linux targets.

If you install it on a Splunk Server, you can enable inputs by GUI, if instead you use it on a Universal Forwarder, you have to manually enable inputs:

• create the local folder in $SPLUNK_HOME/etc/apps/Splunk_TA_nix,
• copying inputs.conf from default to local folder,
• putting disable = 0 to all the stanza inputs,
• restarting splunk on the forwarder.

This TA send logs to the default index (main), if you want to send logs to another index (usually "os"), you have to insert in every stanza of inputs.conf "index = os".

Ciao.

Giuseppe