Splunk Enterprise Security

How can we track changes made in Correlation searches??

ManishVilla7
Explorer

I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved??

 

@woodcock @rmmiller  @Raghav2384 @RVDowning @somesoni2 @gcusello @mayurr98  please help

 

Labels (1)
0 Karma
1 Solution

Jhunter
Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

View solution in original post

amitpanjawani
Explorer

I was searching for the same, then i developed this app for the community. https://splunkbase.splunk.com/app/4144/

0 Karma

Jhunter
Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There's no good way to do that within Splunk.  The audit logs may tell that someone touched a CS, but it won't say what changes were made.

Consider tracking your .conf files in a source management tool like git so you not only know when a change is made, but can revert to a previous instance if necessary.

---
If this reply helps you, an upvote would be appreciated.

ManishVilla7
Explorer

@richgalloway can we at-least get the info of who made the change, search name, time. I am not tracking the exact change made but who all made the changes.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with this query.  Replace "<searchName>" with the URL-encoded name of the search you're interested in.  Or use "saved/searches" for a generic search.

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

---
If this reply helps you, an upvote would be appreciated.
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.