Search audit data in Splunk Mission Control

If you have an admin role, you can search audit logs and audit certain actions using the _audit index in a search. For example, there might be an internal user suspected of compromise. As an admin, you might want a list of every action and change that the user performed over the last month. By searching with the _audit index, you can find changes made to user permissions, incidents, playbook and action runs, response templates, and response template task notes. You can also review these activities using the Mission Control Operation dashboard. See Monitor activities in Splunk Mission Control.

If you deactivated the universal forwarder, you can't access Splunk SOAR logs including action run logs, playbook run logs, and audit logs. To use Splunk SOAR data in searches, turn on the universal forwarder.

To review audit data in Splunk Mission Control, select the Search page and use the following example searches.

Example searches with audit in Splunk Mission Control

Use these example searches to learn more about audit data in Splunk Mission Control.

Audit for updated incidents

To audit for updated incidents, use the following example search.

Updates to fields available in Splunk Enterprise Security are visible in source="notable_update_rest_handler"

index=_audit source=mc_update_rest_handler | rex "(?<timestamp>[\d.]+),(?<incident_id>[\w-]+),(?<user>[\w_]+),(?<model>[\w]+),(?<command>[\w]+),(?<diff>.+)" | eval time=_time | table time, user, incident_id, diff, command

This search returns the following output.

1696010371      sc_admin        cfd8924f-1eaa-4c8c-8786-04c4969b2026    "{\"notes\": [[\"e09d9763-9a4a-4a17-ad75-cf149e9f4b7e\"], [\"e09d9763-9a4a-4a17-ad75-cf149e9f4b7e\", \"a1d46a86-1b78-4f56-898f-17e5a8930c24\"]], \"update_time\": [1696010363.791772, 1696010371.1171799]}"       U   ]

Audit for updated events

To audit for updated events in an incident, use the following example search.

index=_audit source=mc_update_rest_handler | rex "(?<timestamp>[\d.]+),(?<incident_id>[\w-]+),(?<user>[\w_]+),(?<model>[\w]+),(?<command>[\w]+),(?<diff>.+)" | eval time=_time | table time, user, incident_id, diff, command

This search returns the following output.

1696012850      admin   8f665996-cce2-442e-85b9-8cd5ee5fad04    "{\"incident_events_search\": [{\"delete_event_ids\": [], \"earliest\": null, \"event_count\": null, \"latest\": null, \"spl\": null}, {\"delete_event_ids\": [], \"earliest\": 1696012845.391, \"event_count\": 3, \"latest\": 1696012846.391, \"spl\": \"search index=\\"_internal\\" | where _indextime <= 1696012847.0 | head 3 | eval mc_event_id=if(isnotnull(mc_event_id), mc_event_id, _cd + _bkt) | `mc_select_latest_values`\"}], \"searches\": [[], [{\"earliest\": 1696012845.391, \"event_count\": 3, \"event_ids\": [], \"index_latest_time\": 1696012847.0, \"latest\": 1696012846.391, \"sids\": [\"1696012847.71618\"], \"spl\": \"search index=\\"_internal\\" | head 3 \"}]], \"update_time\": [1696011009.99037, 1696012850.401185]}"       U

Audit for updated notes

To audit for updated incident notes, use the following example search.

index=_audit source=mc_notes | rex "(?<timestamp>[\d.]+),(?<incident_id>[\w-]+),(?<user>[\w_]+),(?<model>[\w]+),(?<command>[\w]+),(?<diff>.+)" | eval time=_time | table time, user, incident_id, diff, command

This search returns the following output.

1696010363      sc_admin        e09d9763-9a4a-4a17-ad75-cf149e9f4b7e    "{\"author\": {\"username\": \"sc_admin\"}, \"content\": \"fadf\", \"create_time\": 1696010363.7562284, \"files\": [], \"id\": \"e09d9763-9a4a-4a17-ad75-cf149e9f4b7e\", \"incident_id\": \"cfd8924f-1eaa-4c8c-8786-04c4969b2026\", \"last_edited_by\": null, \"response_plan_info\": null, \"source\": \"cfd8924f-1eaa-4c8c-8786-04c4969b2026\", \"source_type\": \"Incident\", \"title\": \"fsdf\", \"update_time\": 1696010363.7562284}"     C

Audit for updated response templates

To audit for updated response templates, use the following example search.

index=_audit source=mc_response_templates | rex "(?<timestamp>[\d.]+),(?<incident_id>[\w-]+),(?<user>[\w_]+),(?<model>[\w]+),(?<command>[\w]+),(?<diff>.+)" | eval time=_time | table time, user, incident_id, diff, command

This search returns the following output.

1696012382   admin      34b26bd0-008d-4672-a963-5a46c1621f85"{\"create_time\": 1696012382.7335176, \"creator\": \"admin\", \"description\": \"\", \"id\": \"34b26bd0-008d-4672-a963-5a46c1621f85\", \"is_default\": false, \"name\": \"sample%20response%20template\", \"phases\": [{\"create_time\": 1696012382.7339416, \"name\": \"phase1\", \"order\": 1, \"tasks\": [{\"create_time\": 1696012382.7338626, \"description\": \"\", \"end_time\": 0.0, \"files\": [], \"is_note_required\": true, \"name\": \"task1\", \"notes\": [], \"order\": 1, \"owner\": \"\", \"start_time\": 0.0, \"status\": \"Pending\", \"suggestions\": {\"actions\": [], \"playbooks\": [], \"searches\": []}, \"tag\": \"dad58947-5057-41c5-935c-b7d56f53d424\", \"total_time_taken\": 0.0, \"update_time\": 1696012382.733863}], \"update_time\": 1696012382.733942}], \"template_status\": \"draft\", \"update_time\": 1696012382.7335176, \"updated_by\": \"admin\", \"version\": 2.0}"    C

Audit for updated SLA

To audit for SLA changes, use the following example search.

index=_audit source=mc_sla_incident | rex "(?<timestamp>[\d.]+),(?<incident_id>[\w-]+),(?<user>[\w_]+),(?<model>[\w]+),(?<command>[\w]+),(?<diff>.+)" | eval time=_time | table time, user, incident_id, diff, command

This search returns the following output.

1696006975adminff805649-e0cb-4cf7-a540-b34d867e6921"{\"create_time\": 1696006975.5954342, \"id\": \"ff805649-e0cb-4cf7-a540-b34d867e6921\", \"is_default\": false, \"name\": \"test1\", \"rule_string\": \"sensitivity == \\"Red\\" \", \"rules\": [{\"field\": \"sensitivity\", \"operand\": \"==\", \"values\": \"Red\"}], \"sla_time\": {\"units\": \"h\", \"value\": 12, \"value_seconds\": 43200}, \"update_time\": 1696006975.5954342}"C