Documentation: 3.3.2
|  Print Version Contents
This page last updated: 05/28/08 01:05pm

Audit event signing

Splunk creates audit trail information (by creating and signing audit events) when you have auditing enabled. Audit event signing is only available if you are running Splunk with an Enterprise license.

How audit event signing works

The audit processor signs audit events by applying a sequence number ID to the event, and by creating a hash signature from the sequence ID and event's timestamp. Configurable settings for audit event signing are explained in the configure audit events signing.

Sequence numbering

The sequence number ID is useful to detect gaps in data which often identify tampering with the system. When a gap in data is discovered, the gap is "decorated" according to the decoration specification in decorations.conf (which ties to CSS style settings in prefs.conf).

Note: Decoration adds the name of the decoration to the _decoration metadata in the event. The name of this decoration is derived by looking in decorations.conf and mapping the right side of each attribute/value pair to the appropriate key in prefs.conf.

Hash encryption

For each processed audit event, Splunk's auditing processor computes an SHA256 hash on all of the data. The processor then encrypts the hash value and applies Base64 encoding to it. Splunk then compares this value to whatever key (your private key, or the default keys) you specify in audit.conf.

Configure audit event signing

Configure the following settings of Splunk's auditing feature through audit.conf:

  • Turn on and off audit event signing.
  • Set default public and private keys.

Configure audit.conf

Create your own audit.conf. Edit this file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.

Generate your own keys using genAuditKeys.py in $SPLUNK_HOME/bin/:

# python genAuditKeys.py

Note: You may need to set environment variables by running "source setSplunkEnv"

This creates your private and public keys, $SPLUNK_HOME/etc/auth/audit/private.pem and
$SPLUNK_HOME/etc/auth/audit/public.pem}. To use these keys, set {{privateKey and publicKey to the path to your keys in your $SPLUNK_HOME/etc/system/local/audit.conf:

[auditTrail]
privateKey = $PATH_TO_PRIVATE_KEY
publicKey = $PATH_TO_PUBLIC_KEY

Note: If the [auditTrail] stanza is missing, audit events are still generated, but not signed. If the publicKey or privateKey values are missing, audit events will be generated but not signed.

Previous: Audit events    |    Next: Event hashing

Comments

No comments have been submitted.

Log in to comment.