Splunk Search

How to identify unauthorized access to crontab in a Splunk search?

TheJagoff
Communicator

Hello (again)

I am doing the following Linux command testing who has access to crontab.
For a non privileged user, I do the following under the user name "unauth":
mysearchhead> crontab -l
and receive the following:

You (unauth) are not allowed to use this program (crontab)
See crontab(1) for more information

In Splunk, I can see the attempt using:

host="mysearchhead" sourcetype=linux_audit a0=crontab  type=EXECVE

Resulting event is:

6/17/16 2:33:54.039 PM  
type=EXECVE msg=audit(1466174034.039:787184230): argc=2 a0="crontab" a1="-l"
host = mysearchhead     source = /var/log/audit/audit.log    sourcetype = linux_audit

My question is; where is the message stored that user "unauth" is not allowed to use this program?

Many thanks in advance

0 Karma
1 Solution

TheJagoff
Communicator

Found that I would need to ingest the cron log on any server that this condition is required.

View solution in original post

0 Karma

TheJagoff
Communicator

Found that I would need to ingest the cron log on any server that this condition is required.

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!