Splunk Enterprise Security

How to detect when correlation search was deativated or delited?

woodentree
Communicator

Hello,

For internal control, we have to monitor all deactivations and all suppressions of correlation searches. Unfortunately, we were not able to find a corresponding log event in _audit index.

However, all needed information could be find with the search below:

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename action.correlationsearch.label as "Name"
| table Name disabled

The result should look like this:

Name                     | disabled
Outbreak Detected        | 0
SQL Injection Detected   | 0
Threat Activity Detected | 1
Etc.

The question is how we can detect two conditions below:

  • when deactivated field changes its value from 0 to 1
  • when one of Name fields values is not returned anymore

Do you have an idea how those searches could be implemented?

Thanks for the help.

ro_mc
Path Finder

You could append | outputlookup to store the results with the current datetime (e.g. cs_status).

You can then either:

  1. Use | lookup (prior to | outputlookup) to compare current REST results with most recent stored results
  2. Create a separate search (assuming daily lookup of cs_status and time field of cs_time) with:
| inputlookup cs_status 
| search cs_time > relative_time(now(), "-48h") 
| stats count, values(cs_time) as cs_time by Name disabled
| where count=1

If the search is created/deleted, or the disabled state changes, the count should equal one.

If you don't want the search creation and enable events, some additional logic is required to compare the values of all three fields (Name, disabled and cs_time).

0 Karma

srisahitya_v
Communicator

Hey did you get the answer?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...