Splunk Enterprise Security

In Splunk Enterprise Security, how do you access granular audit trails for user and role changes?

MatthewH007
Path Finder

I was looking for a way to view WHAT exactly was audited when someone changes a ROLE or USER (capabilities, inherited roles, indexes, etc).

I found a few searches guiding me to what I had already found on internal indexes, but of course, nothing gets as granular as it should.

I am hoping I just am mistaken and am looking in the wrong place so please re-direct me if that is the case.

Example search:

index=_audit sourcetype=audittrail operation=edit NOT user IN (index-manager, admin) NOT action=search
| table _time user object action info operation 
| sort - _time

The above will give me mostly what I want to know. However, a few things I have found and tested extensively.

A. Navigating in the GUI to a built-in role (such as 'admin') and changed nothing (Access Controls > Users > admin). I then do a search and I'll see the following:

object=admin action=edit_user info=granted operation=edit

This is an issue as NOTHING was changed but we see an action of "edit_user". It would be nice if the granularity would show WHAT was changed, such as capabilities, inherited roles, indexes, etc. But Splunk auditing doesn't show that. I think that is a big gap that should be addressed.

B. If you see "action=edit_role", then that DOES mean that a role was changed. However, "action=edit_user" can mean a user was changed OR it was simply accessed in the GUI.

C. To add even more confusion, when you change a role, you can also see an audit log that shows the same object (such as 'example-role') with "action=edit_user". Meanwhile there is NO SUCH USER as 'example-role'.

I don't think this may ever get cleared up, but should as if something does happen that requires legal action, there is some reasonable doubt that can easily creep in.

Please, if anyone knows of a way to see the granularity I am looking for or if it is on the Splunk Roadmap, then please let me know. Any help is GREATLY appreciated.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...