Simulating security breach using Splunk

Question

I am a newbie of Splunk. Installed splunk on a single EC2 instance and I have another Linux EC2 from which I need some data to be transported. Basically using Splunk I am trying to simulate security breach.

What I am trying to achieve:

In the linux machine, I have a file inside /home/ec2-user/splunk-test/secret-file. I have changed the owner of this file to be user1 who is in group user1g. I have created another user - user2 with no permissions to any apart from his home folder. Now, when I try to access (read/change permissions with or without sudo) this file using user2, I should get a security threat in Splunk.

After research I could know that this can be achieved by enabling auditd function in linux machine, which then needs to be sent to splunk server using universal forwarder. So, I have installed and configured (inputs and outputs) of universal forwarder for Splunk.

After all these I am not able to see: 1. any entries on auditd in Linux machine 2. any threats in Splunk web dashboard.

Can someone please help me at the earliest.?

There's no good category to close this question with, but here's my advice how to rewrite it. Your first problem is with local auditd. If you don't get the log lines locally, splunk will not see them either, so you can completely remove it from the question. Amazon-ec2 has not much to do with the situation, but the distribution you're using may matter. Ask about your auditd problem instead. — viraptor
@viraptor, I have already asked the question here:serverfault.com/questions/847918/… — serverstackqns

serverstackqns serverstackqns · Accepted Answer · 2017-05-03T05:04:10

Here are some of the comments which I recieved for the same question:

https://answers.splunk.com/answers/525729/simulating-security-breach-using-splunk.html

Simulating security breach using Splunk

1 Answers