IT data signing

IT data signing helps you certify the integrity of your IT data. If you enable IT data signing and index some data, Splunk tells you if that data is ever subsequently tampered with at the source. For example, if you have enabled IT data signing and index a log file in Splunk, Splunk will warn you if anyone removes or edits some entries from that log file on the original host. You can thus use Splunk to confirm that your data has been tampered with.

Note: Signing IT data is different than signing Splunk audit events. IT data signing refers to signing external IT data while it is indexed by Splunk; audit events are events that Splunk's auditing feature generates and stores in the audit index.

How IT data signatures work

Splunk takes external IT data (typically in the form of log files), and applies digital signatures and signature verification to show whether indexed or archived data has been modified since the index was initially created.

A signature for a block of IT data involves three things:

A hash is generated for each individual event.
The events are grouped into blocks of a size you specify.
A digital signature is generated and applied to each block of events.

Note: Splunk can encrypt the digital signature if you have configured the public and private keys in audit.conf. See Configure audit event signing for details.

This digital signature is stored in a database you specify and can be validated as needed. Splunk can demonstrate data tampering or gaps in the data by validating the digital signature at a later date. If the signature does not match the data, an unexpected change has been made.

Configure IT data signing

This section explains how to enable and configure IT data signing. You enable and configure IT data signing for each index individually, and then specify one central database for all the signing data.

Set configurations in indexes.conf. Edit this file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work. Do not edit the copy in default.

Then, configure IT data signing by editing the indexes.conf you created.

Enable or disable IT data signing.
Specify the number of events contained in your IT data signatures.
Specify the database to store signing data in.

Note: You must configure audit event signing by editing audit.conf to have Splunk encrypt the hash signature of the entire data block.

Enable or disable IT data signing

Enable and disable IT data signing by changing the value of the blockSignSize= key. This key specifies the number of events that make up a block of data to apply a signature to. By default, IT data signing is turned off on all indexes.

blockSignSize=<integer> (default = 0)

To enable IT data signing, set the blockSignSize= key to any integer value.
This example turns IT data signing ON in index=main, and sets the number of events per each signature block to 100.

[main]
blockSignSize=100
...

To disable IT data signing, set the blockSignSize= key equal to 0.
This example turns IT data signing OFF for index=main.

[main]
blockSignSize=0
...

Specify the number of events in an IT data signature

Specify the number of events in an IT data signature by setting the value of the blockSignSize= key. The default value for all indexes is 0. Set this key to a value greater than 0 to both turn on IT data signing and set the number of events per IT signature block. You must set this key for each index using IT data signing.

Note: the maximum number of events for the blockSignSize key is 2000.

This example sets the number of events in each IT data signature to 100 in index=main.

[main]
blockSignSize=100
...

Define the signature database

The IT data signature information from each index for which you have configured IT data signing is stored in the signature database. Set the value of the blockSignatureDatabase= key to the name of the database where Splunk should store IT signature data. This is a global setting that applies to all indexes.

blockSignatureDatabase=<database name= string> (default = _blocksignature)

View the integrity of IT data

To view the integrity of indexed data at search time, open the Show source window for results of a search. To bring up the Show source window, click the drop-down box at the left of any search result. Select Show source and a window will open displaying the raw data for each search result.

The Show source window displays decorations correlating with whether the block of IT data has gaps, has been tampered with, or is valid (no gaps or tampering).

The default decorations shown for types of events are:

Valid:
Tampered with:
Has gaps in data:

You can customize the decorations by configuring the CSS style associated with the event type. Learn how to configure dynamic event rendering to customize the decorations.

Performance implications

Because of the additional processing overhead, indexing with IT data signing enabled can negatively affect indexing performance. Smaller blocks mean more blocks to sign and larger blocks require more work on display. Experiment with block size to determine optimal performance, as small events can effectively use slightly larger blocks.

Turning IT data signing ON slows indexing.
Setting the blockSignSize= key to high integer values (ex: 1000) slows indexing performance.
For best performance, set blockSignSize= to a value near 100.

Previous: Event hashing | Next: Archive signing

Comments

We've added examples of the default decorations for types of audit events in that section.
Posted by jrosensteel on Jul 24 2008, 6:23pm
Can you show how "the top of the window" indicates whether the block of IT data has gaps? I would like to see examples of valid and invalid.
Posted by splunkattellme on Jul 24 2008, 1:46pm