Splunk Enterprise Security

Where can I find Splunk logs for Content management in Splunk Enterprise security?

yourfriend
Loves-to-Learn

Hello Team,

In our environment, we have created use cases in the content management in Splunk ES. We want to know the query to search for the logs if anyone with Admin access made any changes in the use cases by mistake.

I will explain in detail, someone with admin access had made a change in the use case. To check who changed it, I was trying in splunk _internal with query,
index="_internal" sourcetype=*content_management*
But i am not getting any useful data with this query. 

Please kindly help me where all logs stored for content management(use cases) in Enterprise security.

How to search those logs, if anyone have any idea with query pls let me help with it.

We have to check the internal logs for the changes being made in the content management.

Thanks in advance. Bye Bye !

Tags (1)
0 Karma
1 Solution

Azeemering
Builder

Start with this:

 

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

 Then theres is a REST search:

 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

 

 

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

 

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"

View solution in original post

Azeemering
Builder

Start with this:

 

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

 Then theres is a REST search:

 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

 

 

But I would check out the Correlation Search Audit app for this:

https://splunkbase.splunk.com/app/4144/

 

And that uses an amazingly good search that I use too:

| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...