Splunk Enterprise Security

How to detect when correlation search was deativated or delited?



For internal control, we have to monitor all deactivations and all suppressions of correlation searches. Unfortunately, we were not able to find a corresponding log event in _audit index.

However, all needed information could be find with the search below:

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename action.correlationsearch.label as "Name"
| table Name disabled

The result should look like this:

Name                     | disabled
Outbreak Detected        | 0
SQL Injection Detected   | 0
Threat Activity Detected | 1

The question is how we can detect two conditions below:

  • when deactivated field changes its value from 0 to 1
  • when one of Name fields values is not returned anymore

Do you have an idea how those searches could be implemented?

Thanks for the help.

Path Finder

You could append | outputlookup to store the results with the current datetime (e.g. cs_status).

You can then either:

  1. Use | lookup (prior to | outputlookup) to compare current REST results with most recent stored results
  2. Create a separate search (assuming daily lookup of cs_status and time field of cs_time) with:
| inputlookup cs_status 
| search cs_time > relative_time(now(), "-48h") 
| stats count, values(cs_time) as cs_time by Name disabled
| where count=1

If the search is created/deleted, or the disabled state changes, the count should equal one.

If you don't want the search creation and enable events, some additional logic is required to compare the values of all three fields (Name, disabled and cs_time).

0 Karma


Hey did you get the answer?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...