Splunk Search

how to search for admins who make changes to their own accounts?

ajmach343
Observer

I am trying to make a search that will fire only when an admin makes a change to their own account.

I want to know if a-johndoe gives multiple permissions to a-johndoe and NOT if a-johndoe gives permissions to a-janedoe. 

would i use an IF statement for this?

 

Thank you

Labels (2)
0 Karma

ajmach343
Observer

apologies, this will be for windows event logs and Ivanti logs. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What data are you talking about?

Splunk account changes? Windows Event Logs? Some (what) Linux audit logs?

If your data is CIM-normalized, you should use Change.Account_Management dataset.

0 Karma

ajmach343
Observer

was able to figure it out!

needed to just use an IF statement. 

| eval testuser=if(admin=target,1,0)
| where testuser=1
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...