Cryptographically sign audit events
Splunk creates audit trail information (by creating and signing audit events) when you have auditing enabled. Audit event signing is only available if you are running Splunk with an Enterprise license.
How audit event signing works
The audit processor signs audit events by applying a sequence number ID to the event, and by creating a hash signature from the sequence ID and the event's timestamp. Once you've enabled audit signing, you can search for gaps in the sequence of these numbers and find out if your data has been tampered with.
For each processed audit event, Splunk's auditing processor computes an SHA256 hash on all of the data. The processor then encrypts the hash value and applies Base64 encoding to it. Splunk then compares this value to whatever key (your private key, or the default keys) you specify in audit.conf.
Configure audit event signing
Configure the following settings of Splunk's auditing feature through audit.conf:
- Turn on and off audit event signing.
- Set default public and private keys.
Create your own
audit.conf. Edit this file in
$SPLUNK_HOME/etc/system/local/, or your own custom application directory in
$SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.
Generate your own keys using the CLI:
# ./splunk createssl audit-keys
This creates your private and public keys,
$SPLUNK_HOME/etc/auth/audit/public.pem. To use these keys, set
publicKey to the path to your keys in your
[auditTrail] privateKey = $PATH_TO_PRIVATE_KEY publicKey = $PATH_TO_PUBLIC_KEY
Note: If the
[auditTrail] stanza is missing, audit events are still generated, but not signed. If the
privateKey values are missing, audit events will be generated but not signed.
Search to detect gaps in your data
Once you've configured audit event signing, the sequence number ID that the audit processor assigns to each event lets you detect gaps in data which can identify tampering with the system. You can search the audit events to determine if gaps are detected:
index=_audit | audit
The field that contains the status of the event is called "validity". Values can be:
- VALIDATED - no gap before this event and event signature matches
- TAMPERED - event signature does not match
- NO SIGNATURE - the signature was not found
- NO PUBLIC KEY - cannot validate
The field that contains the gap status is called "gap". Values can be:
- TRUE - a gap was found
- FALSE - no gap was found
- N/A - no id was found
Configure IT data block signing
Audit Splunk activity
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7