Splunk Search

How to set up an alert if a user makes a change to a group?

kavraja
Path Finder

I am fairly new to splunk but I am trying to create a search that would send out an alert whenever a member of a certain group makes a change to any data in the group they are in.

For example, if group x has 10 members, I would want to search for any members in that group that would either add or delete a user into that group.

Thanks for the help.

Tags (3)
1 Solution

jeremiahc4
Builder

Are you talking about internal Splunk groups & members? If so, the best thing would be to ensure those users don't have admin access if you don't want them changing group membership. Barring that, I don't see much in the _internal index for security changes other than the webaccess & splunkd_acccess logs. Even those don't have group membership details, however, you might assume that a POST to the auth pages (/en-US/manager/search/authentication/*) represented a change to something security wise. You may pick up some false positives when someone changes their password though.

View solution in original post

jeremiahc4
Builder

Are you talking about internal Splunk groups & members? If so, the best thing would be to ensure those users don't have admin access if you don't want them changing group membership. Barring that, I don't see much in the _internal index for security changes other than the webaccess & splunkd_acccess logs. Even those don't have group membership details, however, you might assume that a POST to the auth pages (/en-US/manager/search/authentication/*) represented a change to something security wise. You may pick up some false positives when someone changes their password though.

kavraja
Path Finder

Thanks jeremiahc4. Used the

"index=_internal host= method=POST "authentication"

as an example and got it working for what i needed it to do

jeremiahc4
Builder

example search for auth changes in Splunk;

index=_internal host= method=POST "authentication"

It picked up the creation, group change, and password change events for the user I just tried out.

pradeepkumarg
Influencer

How does your event data look like when a user performs addition or deletion? Provide some sample data and what you are expecting out of it..

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...