Splunk Enterprise Security

How to detect when correlation search was deativated or delited?



For internal control, we have to monitor all deactivations and all suppressions of correlation searches. Unfortunately, we were not able to find a corresponding log event in _audit index.

However, all needed information could be find with the search below:

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename action.correlationsearch.label as "Name"
| table Name disabled

The result should look like this:

Name                     | disabled
Outbreak Detected        | 0
SQL Injection Detected   | 0
Threat Activity Detected | 1

The question is how we can detect two conditions below:

  • when deactivated field changes its value from 0 to 1
  • when one of Name fields values is not returned anymore

Do you have an idea how those searches could be implemented?

Thanks for the help.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.