- Splunk Answers
- :
- Using Splunk
- :
- Alerting
- :
- How to create an alert if anyone makes changes in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to create an alert if anyone makes changes in my environment?
in my environment, there are four admins. now i want to create an alert if anyone did any changes on GUI or internal. HOW??? can anyone let me know? thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use Splunk's index="_audit" and user="admin". Based on action field you can identify various user activities.
Refer to Splunk How To video on Youtube for audit security: https://www.youtube.com/watch?v=Qv-34lKnI70
You can also refer to Splunk Documentation for Security: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Searchforauditevents
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i really thank you for your response. what is the term that i have to use for action who did modification.
i.e is it like action=change
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a similar question, if someone did any change to .conf files how to raise a alert.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are multiple actions that you would need to watch. In fact you might have to check your existing logs for such historical transactions.
For example action=add can be used to monitor files/configurations added. You should also use path to identify what kind of file and what location has the file been added. Like path=".xml" OR path=".html" will show a view added to any app.
Similarly for action=update or action=delete
action="change_authentication" monitors change in user authentication
There are several action="edit_*" which monitor specific Splunk component modification. For example, action="edit_view_html" will monitor changes to HTML views created in Splunk (used along with object=<HTML View Name>)
action="login attempt" along with info field will give number of login attempts with failed or successful information.
action="restart_splunkd" will capture details on who/when Splunk instance was restarted
action="search" and action="rtsearch" will give information on Splunk Historical and Real Time searches. You can identify which are the long running queries.
Essentially, you would need to identify and use the specific queries as per your needs.
| makeresults | eval message= "Happy Splunking!!!"
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
Adoption of RUM and APM at Splunk
