How to detect when correlation search was deativated or delited?

[woodentree]

Hello,

For internal control, we have to monitor all deactivations and all suppressions of correlation searches. Unfortunately, we were not able to find a corresponding log event in _audit index.

However, all needed information could be find with the search below:

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename action.correlationsearch.label as "Name"
| table Name disabled

The result should look like this:

Name                     | disabled
Outbreak Detected        | 0
SQL Injection Detected   | 0
Threat Activity Detected | 1
Etc.

The question is how we can detect two conditions below:

• when deactivated field changes its value from 0 to 1
• when one of Name fields values is not returned anymore

Do you have an idea how those searches could be implemented?

Thanks for the help.

[ro_mc]

You could append | outputlookup to store the results with the current datetime (e.g. cs_status).

You can then either:

1. Use | lookup (prior to | outputlookup) to compare current REST results with most recent stored results
2. Create a separate search (assuming daily lookup of cs_status and time field of cs_time) with:

| inputlookup cs_status 
| search cs_time > relative_time(now(), "-48h") 
| stats count, values(cs_time) as cs_time by Name disabled
| where count=1

If the search is created/deleted, or the disabled state changes, the count should equal one.

If you don't want the search creation and enable events, some additional logic is required to compare the values of all three fields (Name, disabled and cs_time).

[srisahitya_v]

Hey did you get the answer?