I understand that 'Splunk Log Files/Index events' can be deleted (made non-searchable) with the 'can_delete' operators if it is enabled at the application layer. However, if our Splunk instances sits on a Unix Server, could the Unix Admin (i.e. using root, etc.) be able to delete or modify the 'Splunk Log Files/Index events'.
Hoping to provide evidence for our auditors to show that the 'Splunk Logs' are restricted and locked down at both the application and Unix layer. That way we can argue the risk is low and no new controls would need to be implemented.
... View more