Splunk Enterprise Security

How to monitor Splunk users Role modifications?

woodentree
Communicator

Hello,

We’d like to monitor role modifications of our Splunk accounts. The goal is to know who modified what role and which user. Unfortunately, we were not able to find a good query to do that.

  • index=_audit action=edit_user has no information about type of change and role changed
  • index=_audit action=edit_roles OR action=edit_roles_grantable has no information of user whose role has been changed
  • And we were not able to figure out if | rest services/authorization/roles could be used for this purpose

In addition, it looks like both index-based requests returns a lot of system events that pollutes the results.

Do you have an idea how the supervision could be set up properly?
Thanks for the help.

0 Karma
1 Solution

woodentree
Communicator

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

View solution in original post

woodentree
Communicator

We've contacted Splunk support: today there is no such option to have all the information we'd like to. Feature request was set up.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...