Splunk Search

How to identify unauthorized access to crontab in a Splunk search?

TheJagoff
Communicator

Hello (again)

I am doing the following Linux command testing who has access to crontab.
For a non privileged user, I do the following under the user name "unauth":
mysearchhead> crontab -l
and receive the following:

You (unauth) are not allowed to use this program (crontab)
See crontab(1) for more information

In Splunk, I can see the attempt using:

host="mysearchhead" sourcetype=linux_audit a0=crontab  type=EXECVE

Resulting event is:

6/17/16 2:33:54.039 PM  
type=EXECVE msg=audit(1466174034.039:787184230): argc=2 a0="crontab" a1="-l"
host = mysearchhead     source = /var/log/audit/audit.log    sourcetype = linux_audit

My question is; where is the message stored that user "unauth" is not allowed to use this program?

Many thanks in advance

0 Karma
1 Solution

TheJagoff
Communicator

Found that I would need to ingest the cron log on any server that this condition is required.

View solution in original post

0 Karma

TheJagoff
Communicator

Found that I would need to ingest the cron log on any server that this condition is required.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.