Security

What is a good search for auditing when someone has accessed or attempted to access a folder on a Redhat 6.3 OS?

CodyQuinney
New Member

Greetings,

I'm utilizing Splunk Enterprise, and I'm wanting to audit whenever someone attempts to access and/or accesses the /var/log/audit folder on a Redhat 6.3 OS. Is there an already established SPL for this? Or does anyone have any suggestions?

V/R,

Cody

0 Karma
1 Solution

DalJeanis
Legend

The answer to your question depends entirely on what you are already logging and ingesting, and your current security architecture. There are such a wide range of available options that posting SPL for you would be a shot in the dark.

The quickest and most certain answer regarding whether that event is already being logged would be for you to attempt to access the folder yourself (and/or have someone with and/or without authority do so) and then, after a reasonable time for ingestion to occur, search for that person's ID in your splunk with index=* and the appropriate time range. If there is a record, then you can identify details of the record to search for.

If there is NO record, then you need to find out how to capture logging for that folder in Redhat, or PAM, or whatever your current tools and apps are for security logging on the host box, and check whether management supports that level of logging detail. The cost of logging every folder access is significant, so I won't be surprised if the events are not currently being captured.

Nonetheless, the above investigation strategy is my go-to for any question like this, because you ALWAYS get an answer, even if it is negative "not currently being logged".

View solution in original post

0 Karma

DalJeanis
Legend

The answer to your question depends entirely on what you are already logging and ingesting, and your current security architecture. There are such a wide range of available options that posting SPL for you would be a shot in the dark.

The quickest and most certain answer regarding whether that event is already being logged would be for you to attempt to access the folder yourself (and/or have someone with and/or without authority do so) and then, after a reasonable time for ingestion to occur, search for that person's ID in your splunk with index=* and the appropriate time range. If there is a record, then you can identify details of the record to search for.

If there is NO record, then you need to find out how to capture logging for that folder in Redhat, or PAM, or whatever your current tools and apps are for security logging on the host box, and check whether management supports that level of logging detail. The cost of logging every folder access is significant, so I won't be surprised if the events are not currently being captured.

Nonetheless, the above investigation strategy is my go-to for any question like this, because you ALWAYS get an answer, even if it is negative "not currently being logged".

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...