Merge pull request #335 from CrossRealms/linux-user-changes

Add changes field in the main alert
CrossRealms · Jun 28, 2023 · 9530d0b · 9530d0b
2 parents 4251957 + 7e99b78
commit 9530d0b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/cyences_app_for_splunk/default/savedsearches.conf b/cyences_app_for_splunk/default/savedsearches.conf
@@ -4164,7 +4164,7 @@ request.ui_dispatch_app = cyences_app_for_splunk
 request.ui_dispatch_view = search
 search = | inputlookup cs_linux_users \
 | addinfo | where _time>=info_min_time and _time <info_max_time \
-| table host UID _time USERNAME COMMAND_SHELL HOME_DIR SUDOACCESS USER_INFO GID status \
+| table host UID _time USERNAME COMMAND_SHELL HOME_DIR SUDOACCESS USER_INFO GID status changes \
 | eval cyences_severity = case(UID=0, "high",1=1, "medium") \
 | `cs_change_in_user_linux_filter`
 action.cyences_notable_event_action = 1
@@ -4198,7 +4198,7 @@ request.ui_dispatch_app = cyences_app_for_splunk
 request.ui_dispatch_view = search
 search = | inputlookup cs_linux_groups \
 | addinfo | where _time>=info_min_time and _time <info_max_time \
-| table _time host group_name users status \
+| table _time host group_name users status changes \
 | eval cyences_severity = case(group_name="root", "high",1=1, "medium") \
 | `cs_change_in_group_of_linux_filter`
 action.cyences_notable_event_action = 1