topic Re: Monitoring Windows Updates from Splunk in Getting Data In

Monitoring Windows Updates from Splunk

kholleran — Tue, 15 Feb 2011 00:46:14 GMT

Hello,

Is there a way to monitor windows updates from Splunk? I have a VBScript that queries a remote machine for update history but for security reasons, our remote registry is turned off on these machines.

Is there a way to simply monitor this history on Splunk? My goal is to match up some of the file system changes that I see on my windows machines to Windows Update timing. I do not want to have to check the update consoles to see what is approved (and this doesn't tell me when they were actually applied).

Thanks for any help.

Kevin

Re: Monitoring Windows Updates from Splunk

Ron_Naken — Tue, 15 Feb 2011 01:55:43 GMT

This is covered by the Windows app, out of the box. It even contains dashboards and reports to track this for you.

Re: Monitoring Windows Updates from Splunk

gkanapathy — Tue, 15 Feb 2011 02:34:32 GMT

You can use the Splunk Windows app. It works by collecting the WindowsUpdate.log file (located in the windows\system32 folder I believe) and parsing out the information that's available from there.

Re: Monitoring Windows Updates from Splunk

MBerikcurtis — Wed, 02 Nov 2011 15:43:40 GMT

BUT what about remote computers? The only way I see is to copy the windowsupdate.log from each remote computer and have splunk index it.

Re: Monitoring Windows Updates from Splunk

lguinn2 — Wed, 02 Nov 2011 16:13:00 GMT

You could put the Splunk Universal Forwarder on each remote Windows computer and have it forward the update logs. That would be beter than copying them.

Re: Monitoring Windows Updates from Splunk

hagjos43 — Mon, 20 Apr 2015 23:24:21 GMT

I know this is old but we just addressed this at work for remote networks that cannot (for a variety of reasons) utilize the windows app. The following query will work to check KB numbers on a Windows box:

sourcetype=WinEventLog:System EventCode=19 | eval Date=strftime(_time, "%Y/%m/%d")| rex "\WKB(?<KB>.\d+)\W" |stats count by Date, host, KB

Posted originally here: http://gosplunk.com/verify-windows-updates-have-been-applied/

Re: Monitoring Windows Updates from Splunk

tiagomiranda — Wed, 02 Mar 2016 12:12:49 GMT

I need to change any settings on the remote machines? I installed Universal Forward on each remote Windows machine but the Windows Update logs didn't come.