Splunk Search

Splunk ES detecting changes to OS auth files

proylea
Contributor

Hi All
We have a request to generate a notable event in Splunk ES for any changes made in the linux OS to /etc/passwd and groups
Does ES have a built in search to detect such a change?
I have no desire to re-invent the wheel

0 Karma

starcher
SplunkTrust
SplunkTrust

That would be reliant on you having data that comes into Splunk that indicates file changes. A good place to start is OSQuery. You can use that to collect such data. Then map the data to the Common Information Model and then make your desired correlation search on that. The old fschange input type in Splunk has been deprecated for a long time so you shouldn't rely on it.

0 Karma

proylea
Contributor

The data input is done and normalised, I guess my question is what will ES do with that information out of the box?

Do I need to write the correlation search or does ES already have one that covers this security scenario?

ie. will ES generate a notable based on that input and changes to passwd and groups files?

Is there an inbuilt ES correlation that just needs to be turned on?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...