Security

What is a good search for auditing when someone has accessed or attempted to access a folder on a Redhat 6.3 OS?

CodyQuinney
New Member

Greetings,

I'm utilizing Splunk Enterprise, and I'm wanting to audit whenever someone attempts to access and/or accesses the /var/log/audit folder on a Redhat 6.3 OS. Is there an already established SPL for this? Or does anyone have any suggestions?

V/R,

Cody

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

The answer to your question depends entirely on what you are already logging and ingesting, and your current security architecture. There are such a wide range of available options that posting SPL for you would be a shot in the dark.

The quickest and most certain answer regarding whether that event is already being logged would be for you to attempt to access the folder yourself (and/or have someone with and/or without authority do so) and then, after a reasonable time for ingestion to occur, search for that person's ID in your splunk with index=* and the appropriate time range. If there is a record, then you can identify details of the record to search for.

If there is NO record, then you need to find out how to capture logging for that folder in Redhat, or PAM, or whatever your current tools and apps are for security logging on the host box, and check whether management supports that level of logging detail. The cost of logging every folder access is significant, so I won't be surprised if the events are not currently being captured.

Nonetheless, the above investigation strategy is my go-to for any question like this, because you ALWAYS get an answer, even if it is negative "not currently being logged".

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The answer to your question depends entirely on what you are already logging and ingesting, and your current security architecture. There are such a wide range of available options that posting SPL for you would be a shot in the dark.

The quickest and most certain answer regarding whether that event is already being logged would be for you to attempt to access the folder yourself (and/or have someone with and/or without authority do so) and then, after a reasonable time for ingestion to occur, search for that person's ID in your splunk with index=* and the appropriate time range. If there is a record, then you can identify details of the record to search for.

If there is NO record, then you need to find out how to capture logging for that folder in Redhat, or PAM, or whatever your current tools and apps are for security logging on the host box, and check whether management supports that level of logging detail. The cost of logging every folder access is significant, so I won't be surprised if the events are not currently being captured.

Nonetheless, the above investigation strategy is my go-to for any question like this, because you ALWAYS get an answer, even if it is negative "not currently being logged".

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...