topic Re: Splunk as Patch Management in Splunk Dev

Splunk as Patch Management

test_qweqwe — Thu, 28 Dec 2017 11:55:56 GMT

Hello.
How best to implement Patch Management in Splunk for Win\Linux?
Maybe some blogs, articles, APPs that can help me.

Re: Splunk as Patch Management

nikita_p — Thu, 28 Dec 2017 12:06:05 GMT

Hi @test_qweqwe,
Could you go through below splunk docs?
https://docs.splunk.com/Documentation/PCI/3.4.1/Install/SystemPatchStatus

Re: Splunk as Patch Management

test_qweqwe — Thu, 28 Dec 2017 12:42:45 GMT

Yes, I saw this article, but I still not understand how can i realize it.

Re: Splunk as Patch Management

richgalloway — Thu, 28 Dec 2017 14:24:09 GMT

That article is part of a larger document for the Splunk App for PCI Compliance app. The article by itself is not very helpful - you'd need to read most of the entire document and even then it's of little use without installing the app. One gets the app from Splunk Sales so there may be an extra cost involved.

Re: Splunk as Patch Management

richgalloway — Thu, 28 Dec 2017 14:37:21 GMT

It's not clear what you mean by "patch management".

Perhaps you want to deploy patches to your Windows and Linux servers. Splunk is not a patch management system. You would need a separate product, like Microsoft SCCM or IBM Bigfix for that.

Perhaps you want to patch Splunk itself. Splunk does not ship patches. New versions of Splunk are released at intervals. To keep your Splunk instances current, install the new versions when they come out. Many shops choose to stay one or two versions to avoid unknown bugs.

Perhaps you want to track which patches are installed on your Windows and Linux systems. This is a great use for Splunk. You will, however, need a way to feed Splunk with two lists: 1) the software installed on your systems, including patch identifiers; 2) the software expected to be on those systems, including patch identifiers. Splunk can identify differences between those lists and highlight them for you.

Re: Splunk as Patch Management

test_qweqwe — Thu, 28 Dec 2017 19:10:41 GMT

Yea, I need to track which patches are installed on my Windows and Linux systems.
But I really don't know how to realize such solution and I asked for some help, maybe there are already implemented solutions? Maybe some apps?

Re: Splunk as Patch Management

spayneort — Thu, 28 Dec 2017 22:27:16 GMT

Bringing Sweetness to Sour Patch Tuesday – Using Splunk for Easier Patch Management

Re: Splunk as Patch Management

test_qweqwe — Thu, 28 Dec 2017 22:46:08 GMT

Perfect! Love u!