Splunk Security Essentials: Scheduled Tasks

BluFalcon — Wed, 16 Mar 2022 21:07:45 GMT

I hope this is the right place to post this if not please let me know where to post it. There are multiple use-cases for Task Scheduler in the SSE app, my question pertains to all that are based on EventID=4698

None of these searches seem to work in my environment out of box, I checked and my Windows TA is up to date. Not sure if there is another TA required? Here is on as an example and how I fixed it:

`wineventlog_security` EventCode=4698
| xmlkv Message
| search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*")
| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `winevent_scheduled_task_created_within_public_path_filter`

To fix this query I ended up changing line 2 to:
| xmlkv TaskContent

And line 4 to:
| stats count min(_time) as firstTime max(_time) as lastTime by dest, TaskName, Command, Author, Enabled, Hidden, Arguments

I dont know if I am missing something or if this is broken out of the box, if so is there somewhere to report this?

Re: Splunk Security Essentials: Scheduled Tasks

richgalloway — Thu, 17 Mar 2022 12:41:22 GMT

First, make sure you have the most recent version of the app. If the errors still exist, file a case with Splunk since that is a supported app. See https://splunkcommunities.force.com/customers/apex/SubmitCase

Re: Splunk Security Essentials: Scheduled Tasks

BluFalcon — Thu, 17 Mar 2022 14:04:43 GMT

@richgalloway thank you.

topic Splunk Security Essentials: Scheduled Tasks in All Apps and Add-ons

Splunk Security Essentials: Scheduled Tasks

Re: Splunk Security Essentials: Scheduled Tasks

Re: Splunk Security Essentials: Scheduled Tasks