Splunk Search

Can Splunk read inside a file and filter based on a word inside?

NizanCohen
Explorer

Hi all.

I want to create an alert for hosts file modification.

Found the build in one here on the forums but I would like to add a filter that can read inside the file and when it's being modified by Docker, it would ignore and won't activate the alert.

 

Appreciate the assistance!

0 Karma

NizanCohen
Explorer

I don't need to know who modified it but to filter out all Docker's updates (which are automatic).

https://research.splunk.com/deprecated/windows_hosts_file_modification/

^that's the alert I currently using for that.

I would like to filter out Docker so when there is a machine with Docker related update, it won't alert me.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I don't need to know who modified it but to filter out all Docker's updates (which are automatic).

@NizanCohen that is exactly what richgalloway points out: How does Splunk (or anybody/anything, for that matter) know?

If you know of a signal to tell whether there is a Docker related update in events that your Splunk receives, there is always a way to do it.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of anything tells Splunk *who* is modifying a file.  Splunk just gets the new data immediately after it is written.

If there is something in the data itself that says it was written by Docker then you could recognize that and send the line to the null queue.

---
If this reply helps you, Karma would be appreciated.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

@richgalloway I think the idea is for Docker to leave a mark (e.g., a comment) in /etc/hosts to indicate that it intentionally modified the file.  But without information about how the original alert is set up, all we can say is "yes, it is possible," even though a plausible implementation could be cumbersome.

Additionally, using marker in hosts file itself leaves the file open to malicious attacks.  Another possible way to suppress a given alert on condition is to design a separate message path from Docker into Splunk.  All these are doable.  The question is how much effort.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...