Splunk Enterprise Security

How to monitor Splunk users Role modifications?

woodentree
Communicator

Hello,

We’d like to monitor role modifications of our Splunk accounts. The goal is to know who modified what role and which user. Unfortunately, we were not able to find a good query to do that.

  • index=_audit action=edit_user has no information about type of change and role changed
  • index=_audit action=edit_roles OR action=edit_roles_grantable has no information of user whose role has been changed
  • And we were not able to figure out if | rest services/authorization/roles could be used for this purpose

In addition, it looks like both index-based requests returns a lot of system events that pollutes the results.

Do you have an idea how the supervision could be set up properly?
Thanks for the help.

0 Karma
1 Solution

woodentree
Communicator

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

View solution in original post

woodentree
Communicator

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...