How can we track changes made in correlation searches?

[ManishVilla7]

I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved??

Please help.

[amitpanjawani]

I was searching for the same, then i developed this app for the community. https://splunkbase.splunk.com/app/4144/

[Jhunter · Accepted solution]

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

[wabesman_OG]

Going through the audit logs I found this query helpful.

index=_audit action=create_saved_search actions=* app=* disabled=* info=* user=*
| table _time savedsearch user action actions app disabled info

[richgalloway]

There's no good way to do that within Splunk.  The audit logs may tell that someone touched a CS, but it won't say what changes were made.

Consider tracking your .conf files in a source management tool like git so you not only know when a change is made, but can revert to a previous instance if necessary.

[ManishVilla7]

@richgalloway can we at-least get the info of who made the change, search name, time. I am not tracking the exact change made but who all made the changes.

[richgalloway]

Start with this query.  Replace "<searchName>" with the URL-encoded name of the search you're interested in.  Or use "saved/searches" for a generic search.

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"