+
+
+
+ Monitor your Splunk instance with ease
+ Splunk Audit Trail provides real-time visibility into user activity and knowledge object changes using data from the _audit index. Designed for security and compliance. Main purpose of this app is to improve auditors experience from compliance and operational perspectives. This app helps detect unauthorized changes, track admin modifications, and troubleshoot issues efficiently. Currently it provides two dashboards: User Activity Dashboard, which displays human users activities like: logins, searches, failed login attempts, and admin actions, and Knowledge Object Changes Dashboard, which monitors state mutations of saved searches, dashboards, reports, lookups, field extractions, etc. But this is just a start base. You can add your own dashboards with data which gives you most valuable data. +
+ + Splunk Audit Trail provides real-time visibility into user activity and knowledge object changes using data from the _audit index. Designed for security and compliance. Main purpose of this app is to improve auditors experience from compliance and operational perspectives. This app helps detect unauthorized changes, track admin modifications, and troubleshoot issues efficiently. Currently it provides two dashboards: User Activity Dashboard, which displays human users activities like: logins, searches, failed login attempts, and admin actions, and Knowledge Object Changes Dashboard, which monitors state mutations of saved searches, dashboards, reports, lookups, field extractions, etc. But this is just a start base. You can add your own dashboards with data which gives you most valuable data. +
+ 
+
+
+ + The Dashboards +
+ +
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+ Users activities dashboard
+
+ Presents actions performed by users in Splunk, monitoring user activity logs and interactions. + +
+
+ + Presents actions performed by users in Splunk, monitoring user activity logs and interactions. + +
+ 
+
+
+ 
+ + Some Filters You Can Use +
+ +
+ 
+
+
+
+ Actions
+ The Actions filter exists in both dashboards. In the Audit Trail Users dashboard, the Actions dropdown contains all available values for actions performed by users. In the Audit Trail Objects dashboard, the Actions dropdown includes three values: Create, Update, and Delete. These values cover all CUD (Create, Update, Delete) actions related to specific objects. +
+
+
+ + The Actions filter exists in both dashboards. In the Audit Trail Users dashboard, the Actions dropdown contains all available values for actions performed by users. In the Audit Trail Objects dashboard, the Actions dropdown includes three values: Create, Update, and Delete. These values cover all CUD (Create, Update, Delete) actions related to specific objects. +
+ 
+
+
+
+ Types
+ The Types filter is an element of the Audit Trail Objects dashboard. It lists the types of modified objects. Possible values include: dashboard (for views and dashboards), prebuilt_panel, user, saved_search, etc. +
+
+ + The Types filter is an element of the Audit Trail Objects dashboard. It lists the types of modified objects. Possible values include: dashboard (for views and dashboards), prebuilt_panel, user, saved_search, etc. +
+ 
+
+
+
+ Context
+ The Context filter is element of the Audit Trail Users dashboard. For each action, one attribute is chosen that best represents the context of that action. The best context value for the search action is the value of the 'provenance' attribute. For modifications of objects (such as views, users, saved searches, mapping groups, etc.), the best context value is the object's name. +
+
+ + The Context filter is element of the Audit Trail Users dashboard. For each action, one attribute is chosen that best represents the context of that action. The best context value for the search action is the value of the 'provenance' attribute. For modifications of objects (such as views, users, saved searches, mapping groups, etc.), the best context value is the object's name. +
+ 
+
+
+
+
+ SPL conditions
+
+
+ The SPL conditions filter is element of both dashboards and in both dashboards it works in the same way. Using this input, the Auditor can provide a spl condition, which will be inserted into data retrieving query, changing data displayed in the dashboard. E.g "user = foo" +
+
+ + The SPL conditions filter is element of both dashboards and in both dashboards it works in the same way. Using this input, the Auditor can provide a spl condition, which will be inserted into data retrieving query, changing data displayed in the dashboard. E.g "user = foo" +
+
+ +
+
+
+
+
+
+
+ 
+ 
+
+
+
+
+
+
+