Splunk Enterprise Security

How can we track when Correlation searches were created

LIP
Loves-to-Learn

Hello

We have multiple people working on the content in Splunk Enterprise Security, and I need to be able to find when Correlation searches were created

What is the way to find it?

 

 
 

 

Labels (1)
0 Karma

marysan
Communicator

Hello

Im working with splunk version 7.2.3 and I suppose that this query can help you : (instead of author!= admin ypu can list your favorite authors)

| rest /services/saved/searches splunk_server=local count=0
| search author!="admin" AND action.correlationsearch.enabled=1
           | stats values(updated) as updated , values(action.correlationsearch.enabled) by title,author
           | sort - updated

Tags (1)
0 Karma

LIP
Loves-to-Learn

Thanx, but this will give when the rule was updated and not when it was created.

0 Karma

marysan
Communicator

Hello

I checked It
for new rules, it shows the date of creation 

0 Karma

LIP
Loves-to-Learn

yes, you're right. 
bUt, If user will edit the rules this date also will change and we will not be able to monitor old rule creation data (after user will update the rule)

 

 

0 Karma

marysan
Communicator

OK. if you want to follow just creation, I have a best solution for you with lookup , to recognize new correlations :

1- first run this query just 1 time, to primitive lookup update: 
| rest /services/saved/searches splunk_server=local count=0
| search author!="admin" AND action.correlationsearch.enabled=1
           | table title,author
           | eval flag=1
           | outputlookup test2.csv

2-then make an alert or report and define a time schedule for that with this query to recognize new correlations created during alert/report time period (all titles that there is no flag=1 for them in lookup)  :

| rest /services/saved/searches splunk_server=local count=0
| search author!="admin" AND action.correlationsearch.enabled=1
            | table title,author
            | lookup test2.csv title as title output flag
            |search NOT flag=*
            | eval flag=1
            | outputlookup append=T test2.csv

as a result this query list for you just new correlations , for example if your time schedule is every day at 7 AM, it lists for you all correlation searches were create between yesterday 7 AM - today 7 AM

Tags (2)
0 Karma

LIP
Loves-to-Learn

Thanks for this, but this table will be without "time" (only a list of rules names), and we will not be able to understand when the rules were created.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Configuration Change Tracker feature in Splunk 9.0 will do that.  Just look for changes to savedsearches.conf.

Prior to Splunk 9.0, you'll have to process the access logs to find new CSs.

---
If this reply helps you, Karma would be appreciated.
0 Karma

13Noodles
New Member

Do you have a specific example? I'm looking through the _configtracker index and not seeing any relevant info for savedsearches.conf changes.

0 Karma

LIP
Loves-to-Learn

Yes, I am using Splunk 8.X

What do I need to do in order to process the access logs to find new CSs?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

So it looks like I overstated things a little.

Splunk 9.0 does indeed let you track changes to savedsearches.conf.  However, I can't find anything in the internal logs in 8.x that shows a new CS was created.  Sorry about that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...