Create an audit trail in a unified logging format using Activity logs in Splunk Enterprise Security

Activity logs provide a tamper-proof audit trail and a detailed description of all changes made to a finding, finding group, or investigation. These logs in Splunk Enterprise Security also displays data in a unified logging format that can be parsed by dashboards or custom searches. For more information on customizing Splunk Enterprise Security dashboards to fit your use case, see Customize Splunk Enterprise Security dashboards to fit your use case.

Activity logs help to track all modifications and deletions in an investigation, the user that made the changes, and the time when the change was made in addition to many other details. This ensures data integrity and transparency and helps to recover data for deleted records, thereby strengthening the security posture of AI-driven investigation workflows and mitigate prompt injection risks.

All changes to investigations, findings, queues, queue permissions, investigation types, custom fields, artifact configurations, and AI analysis are recorded by the Activity logs in the mc_history index.

You can view the Activity logs in Splunk Enterprise Security using any of the following ways:

  • In the UI for Splunk Enterprise Security: Access the Response history in the side panel of any finding, finding group, or investigation . You can also view the Activity logs in the Investigation overview page.
  • Macros in the Search bar to search the mc_history index where the Activity logs are recorded.
    Note: You must have administrator level access to use the mc_history index and use the search bar to view the Activity logs. To use any of the macros directly in search, you must have an administrator level access. To call the API (/history) you just need to have read access for that finding or investigation.
  • REST API /history to view any changes to findings and investigations. For more information, see Splunk Enterprise Security API Reference.
    Note: You must have read access to the finding or investigation to use the /history endpoint and view the change history in the Activity logs.

You can also use the mcprocesshistory custom command to process and format data by ingesting event logs from a search on the mc_history index and the add tracking information such as a short description of the change, the ES version for which the change was made, and so on. Following are the three supported modes for this custom command:

  • Latest: Displays the most recent state of each field for an artifact, investigation, and so on. This is the default mode.

  • History: Displays the history of each individual event for an Activity or Timeline view. For example
    CODE 
    | mcprocesshistory mode="history"

  • Rebuild: Reconstructs the complete current state of the artifact by replaying all patches on top of the initial record.

View Activity logs in Splunk Enterprise Security UI

  1. In Splunk Enterprise Security, select the investigation that you want to review from the analyst queue in the Mission Control page.
  2. Select View details to open the overview side panel.
  3. From the overview side panel for the investigation, finding group, or finding, access the Response History section.
  4. Select Load activity log button.
    Note: For investigations, you can view all the updates made to the investigation and all the included findings in the investigation. This includes the time when the investigation was started, the users who made updates, the change summary details, and so on. For finding groups, you can view all the updates made to the finding group and all the included findings in the finding group.
  5. Go to the View investigation side panel. Changes made to the following fields: Owner, Status, Urgency, Disposition, and Notes and changes made to actions such as Upload files, Response plans, or Add findings are recorded within the Activity log section.
    Note: Any modifications that you make to the finding groups or investigations are displayed in the Activity log but you must re-load the Activity log. You also have the option to download the detailed Activity log in CSV format, which can contain a maximum of 500 events.
  6. Select the checkbox for Apply changes to included findings to ensure that all changes carry over to all the findings inside the investigation.
  7. Select Save.

Use search macros in the search bar to view activity logs

Use macros in the Search bar of Splunk Enterprise Security to search the mc_history index where the Activity logs are recorded. Search macros are reusable chunks of SPL that you can insert into other searches.
Note: You must have administrator level access to access the mc_history index.

The following table lists the macros that you can use to search the mc_history index along with their usage and examples:

Note: The mc_incidents and mc_incident_by_id macros are deprecated.
Macro Usage Definition Examples
mc_archive Returns the latest state of all archived objects across all collections. Results are de-duplicated by the ID of the object.
CODE 
search index= "mc_history" is_archive_record=true | dedup
object_id | localop | mcprocesshistory mode = "history"

`mc_archive`
mc_incidents_archive Returns the latest state of all archived objects for the mc_incidents collection.
CODE 
search index = "mc_history" collection = "mc_incidents"
is_archive_record = true | dedup object_id | localop | mcprocesshistory mode = "history"
CODE 
`mc_incidents_archive`
mc_object_history(1) Returns a complete chronological change history for a single object based on ID of the object and finding.
CODE 
index = "mc_history" (object_id="$object_id$" OR finding_id
= "$object_id$" | localop | mcprocesshistory mode = "history"
)
CODE 
`mc_object_history(<object_id>)`
mc_history_latest_records Returns the most recent event for every artifact in the index, which is the latest snapshot for each artifact.
CODE 
index = "mc_history" | evetstats max(_time) as_max_time by
object_id | where _time = _max_time | fields-_max_time |  localop | mcprocesshistory
CODE 
`mc_history_latest_records`
mc_activity_feed(1) Activity feed for a single object. Displays all the events in history for that object.
CODE 
index = "mc_history"
(object_id="$object_id$" OR finding_id = "$object_id$" |
localop | mcprocesshistory | `mc_activity_feed_format`
CODE 
`mc_activity_feed(<object_id>)`
mc_activity_feed(2) Extended activity feed, which can optionally include the history from child findings and included findings in an investigation or finding group. Controlled by the include_findings argument.
CODE 
index = "mc_history" [`mc_activity_feed_ids($object_id$,$include_findings$)`]
| localop | mcprocesshistory | `mc_activity_feed_format`
CODE 
`mc_activity_feed(<object_id>, Boolean)`