All Apps and Add-ons

Database Intrusion Detection

praveentandra
New Member

Does Splunk have any modules to detect database intrusion i.e. indicate anomalies in access patterns? Or any functionality to process database logs.

Tags (2)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The underlying issue with the question is that anomalies are relative to something... your particular users, your particular data, your particular applications, your particular seasonality, and so on.

In some companies, accessing a production database on a night or a weekend would be an anomaly. Others, FAILURE to access the database would be an anomaly.

Splunk has lots of features for detecting and analyzing unusual or interesting events.

The first step is to get the logs into splunk. Then, ask a question about access patterns, pull the relevant data, and get yourself a simple answer. Repeat, repeat, repeat.

Whenever you find the answer is not simple, or the data is not understandable, then post some non-confidential details about the issue in a new question and we will help you figure out how to think about the data you have, or how to reorganize it to make sense.

But the first step is acquiring a feed from the audit logs themselves, and getting them into splunk (or any other awesome tool) so that they can be examined.

0 Karma

lguinn2
Legend

Splunk does not have "modules" - instead there are "apps." Most apps are free, and you can find them at http://splunkbase.splunk.com

There are several free apps that help you ingest and analyze database logs.
There is also the Splunk App for Enterprise Security, which does a whole lot more than that, but is not free. Here is a fact sheet for the Splunk App for Enterprise Security.

0 Karma

praveentandra
New Member

Could you point me to more detailed documentation? I am looking for i) auditing access to sensitive data ii) anomaly in access patterns; specifically for SQL Server database.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...