Splunk Enterprise Security

How to monitor Splunk users Role modifications?

woodentree
Communicator

Hello,

We’d like to monitor role modifications of our Splunk accounts. The goal is to know who modified what role and which user. Unfortunately, we were not able to find a good query to do that.

  • index=_audit action=edit_user has no information about type of change and role changed
  • index=_audit action=edit_roles OR action=edit_roles_grantable has no information of user whose role has been changed
  • And we were not able to figure out if | rest services/authorization/roles could be used for this purpose

In addition, it looks like both index-based requests returns a lot of system events that pollutes the results.

Do you have an idea how the supervision could be set up properly?
Thanks for the help.

0 Karma
1 Solution

woodentree
Communicator

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

View solution in original post

woodentree
Communicator

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...