Splunk ES detecting changes to OS auth files

[proylea]

Hi All
We have a request to generate a notable event in Splunk ES for any changes made in the linux OS to /etc/passwd and groups
Does ES have a built in search to detect such a change?
I have no desire to re-invent the wheel

[starcher]

That would be reliant on you having data that comes into Splunk that indicates file changes. A good place to start is OSQuery. You can use that to collect such data. Then map the data to the Common Information Model and then make your desired correlation search on that. The old fschange input type in Splunk has been deprecated for a long time so you shouldn't rely on it.

• https://code.facebook.com/posts/844436395567983/introducing-osquery/
• http://docs.splunk.com/Documentation/CIM/4.8.0/User/ChangeAnalysis

[proylea]

The data input is done and normalised, I guess my question is what will ES do with that information out of the box?

Do I need to write the correlation search or does ES already have one that covers this security scenario?

ie. will ES generate a notable based on that input and changes to passwd and groups files?

Is there an inbuilt ES correlation that just needs to be turned on?