What is a good search for auditing when someone has accessed or attempted to access a folder on a Redhat 6.3 OS?

[CodyQuinney]

Greetings,

I'm utilizing Splunk Enterprise, and I'm wanting to audit whenever someone attempts to access and/or accesses the /var/log/audit folder on a Redhat 6.3 OS. Is there an already established SPL for this? Or does anyone have any suggestions?

V/R,

Cody

[DalJeanis · Accepted solution]

The answer to your question depends entirely on what you are already logging and ingesting, and your current security architecture. There are such a wide range of available options that posting SPL for you would be a shot in the dark.

The quickest and most certain answer regarding whether that event is already being logged would be for you to attempt to access the folder yourself (and/or have someone with and/or without authority do so) and then, after a reasonable time for ingestion to occur, search for that person's ID in your splunk with index=* and the appropriate time range. If there is a record, then you can identify details of the record to search for.

If there is NO record, then you need to find out how to capture logging for that folder in Redhat, or PAM, or whatever your current tools and apps are for security logging on the host box, and check whether management supports that level of logging detail. The cost of logging every folder access is significant, so I won't be surprised if the events are not currently being captured.

Nonetheless, the above investigation strategy is my go-to for any question like this, because you ALWAYS get an answer, even if it is negative "not currently being logged".