Splunk Enterprise Security

How can we track changes made in correlation searches?

ManishVilla7
Explorer

I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved??

Please help.

 

Labels (1)
0 Karma
1 Solution

Jhunter
Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

View solution in original post

amitpanjawani
Explorer

I was searching for the same, then i developed this app for the community. https://splunkbase.splunk.com/app/4144/

Jhunter
Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

wabesman_OG
New Member

Going through the audit logs I found this query helpful.

 

index=_audit action=create_saved_search actions=* app=* disabled=* info=* user=*
| table _time savedsearch user action actions app disabled info

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no good way to do that within Splunk.  The audit logs may tell that someone touched a CS, but it won't say what changes were made.

Consider tracking your .conf files in a source management tool like git so you not only know when a change is made, but can revert to a previous instance if necessary.

---
If this reply helps you, Karma would be appreciated.

ManishVilla7
Explorer

@richgalloway can we at-least get the info of who made the change, search name, time. I am not tracking the exact change made but who all made the changes.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with this query.  Replace "<searchName>" with the URL-encoded name of the search you're interested in.  Or use "saved/searches" for a generic search.

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...