Splunk Enterprise Security

How can we track changes made in Correlation searches??

Explorer

I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved??

 

@woodcock @rmmiller  @Raghav2384 @RVDowning @somesoni2 @gcusello @mayurr98  please help

 

Labels (1)
0 Karma
1 Solution

Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

View solution in original post

Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

View solution in original post

SplunkTrust
SplunkTrust

There's no good way to do that within Splunk.  The audit logs may tell that someone touched a CS, but it won't say what changes were made.

Consider tracking your .conf files in a source management tool like git so you not only know when a change is made, but can revert to a previous instance if necessary.

---
If this reply helps you, an upvote would be appreciated.

Explorer

@richgalloway can we at-least get the info of who made the change, search name, time. I am not tracking the exact change made but who all made the changes.

0 Karma

SplunkTrust
SplunkTrust

Start with this query.  Replace "<searchName>" with the URL-encoded name of the search you're interested in.  Or use "saved/searches" for a generic search.

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

---
If this reply helps you, an upvote would be appreciated.