Splunk Enterprise Security

How to monitor Splunk users Role modifications?

Path Finder

Hello,

We’d like to monitor role modifications of our Splunk accounts. The goal is to know who modified what role and which user. Unfortunately, we were not able to find a good query to do that.

  • index=_audit action=edit_user has no information about type of change and role changed
  • index=_audit action=edit_roles OR action=edit_roles_grantable has no information of user whose role has been changed
  • And we were not able to figure out if | rest services/authorization/roles could be used for this purpose

In addition, it looks like both index-based requests returns a lot of system events that pollutes the results.

Do you have an idea how the supervision could be set up properly?
Thanks for the help.

0 Karma
1 Solution

Path Finder

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

View solution in original post

Path Finder

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!