Securing Splunk Enterprise

Audit Splunk activity

With auditing enabled, Splunk logs distinct events to the audit index (index=_audit). Interactions with Splunk such as searches and configuration changes generate audit events.

What's in an audit event?

• Timestamp:
  • date and time of the event.
• User information:
  • the user who generated the event.
  • If the event contains no user information, Splunk sets the user to whoever is currently logged in.
• Additional information:
  • available event details -- what file, success/denial, etc.

Activities that generate audit events

Audit events are generated from:

• all files in Splunk's configuration directory $SPLUNK_HOME/etc/*
  • files are monitored for add/change/delete using the file system change monitor.
• system start and stop.
• users logging in and out.
• adding / removing a new user.
• changing a user's information (password, role, etc).
• execution of any capability in the system.
  • capabilities are listed in authorize.conf

Audit event storage

Splunk stores audit events locally in the audit index (index=_audit). Audit events are logged in the log file: $SPLUNK_HOME/var/log/splunk/audit.log.

If you have configured Splunk as a forwarder in a distributed setting, audit events are forwarded like any other event.