Splunk Enterprise Security

Where can I find Splunk logs for Content management in Splunk Enterprise security?

yourfriend
Loves-to-Learn

Hello Team,

In our environment, we have created use cases in the content management in Splunk ES. We want to know the query to search for the logs if anyone with Admin access made any changes in the use cases by mistake.

I will explain in detail, someone with admin access had made a change in the use case. To check who changed it, I was trying in splunk _internal with query,
index="_internal" sourcetype=*content_management*
But i am not getting any useful data with this query. 

Please kindly help me where all logs stored for content management(use cases) in Enterprise security.

How to search those logs, if anyone have any idea with query pls let me help with it.

We have to check the internal logs for the changes being made in the content management.

Thanks in advance. Bye Bye !

Tags (1)
0 Karma
1 Solution

Azeemering
Builder

Start with this:

 

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

 Then theres is a REST search:

 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

 

 

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

 

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"

View solution in original post

Azeemering
Builder

Start with this:

 

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

 Then theres is a REST search:

 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

 

 

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

 

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...