Splunk ES 4.5 - How do we track removed 'investigations' created against a notable event?

[lakshman239]

I understand we can use the following to look at the investigations created which are 'Active'.

|inputlookup append=t investigative_canvas_lookup
|inputlookup append=t investigative_canvas_entries_lookup

How to audit/track 'removed' investigations by an analyst? The info in _audit index logs seems to not capture 'delete/remove investigations'. Any pointers/help would be appreciated.

[lakshman239]

Thx luke and looking for a solution in near future

[LukeMurphey]

We don't currently have sufficient audit trail info for this case. We have an enhancement request to do this. For reference, the enhancement request number is SOLNESS-10790.

I'll try to remember to post back here once this gets done.

[lakshman239]

Thx Luke. How about for items 2 and 3 above. Just curious

[LukeMurphey]

Good question.

That enhancement request is not just to increase auditing for item 1 but to make sure we log thoroughly (which should include all three plus other actions). Our goal is to make it where any change to an investigation is logged.

[DEAD_BEEF]

Any update on request SOLNESS-10790?

[lakshman239 · Accepted solution]

Thx Luke. Looking for the 1st one mainly

[LukeMurphey]

For clarification, which were you wanting to track:

1. Deleted investigations
2. Notables removed from investigations
3. Records of notables that were deleted that had been associated with an investigation

[gonz0]

I have run this same search, but I get no results even tho i have investigations in journal created. how would I create such a list of all journal entries?

[lakshman239]

Item 1 above pls