Splunk Enterprise Security

Where can I find Splunk logs for Content management in Splunk Enterprise security?

yourfriend
Loves-to-Learn

Hello Team,

In our environment, we have created use cases in the content management in Splunk ES. We want to know the query to search for the logs if anyone with Admin access made any changes in the use cases by mistake.

I will explain in detail, someone with admin access had made a change in the use case. To check who changed it, I was trying in splunk _internal with query,
index="_internal" sourcetype=*content_management*
But i am not getting any useful data with this query. 

Please kindly help me where all logs stored for content management(use cases) in Enterprise security.

How to search those logs, if anyone have any idea with query pls let me help with it.

We have to check the internal logs for the changes being made in the content management.

Thanks in advance. Bye Bye !

Tags (1)
0 Karma
1 Solution

Azeemering
Builder

Start with this:

 

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

 Then theres is a REST search:

 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

 

 

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

 

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"

View solution in original post

Azeemering
Builder

Start with this:

 

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

 Then theres is a REST search:

 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

 

 

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

 

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...