topic Re: How to view host disk encryption status in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-view-host-disk-encryption-status/m-p/593162#M206457 <P>Do you have data in splunk that denotes that the disk in encrypted?&nbsp; There are a few things to know here:</P><UL><LI>Where your data is stored (index)</LI><LI>What differentiates your data&nbsp; (sourcetype, source, etc)</LI><LI>Is your data that you need being monitored?&nbsp;</LI></UL><P>Specifically for BitLocker, those are included in Windows Events.&nbsp; This answer may be helpful in finding where they are:&nbsp;<A href="https://community.splunk.com/t5/Getting-Data-In/Retrieving-Windows-Event-logs-with-hyphens-in-the-name/m-p/441245" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Retrieving-Windows-Event-logs-with-hyphens-in-the-name/m-p/441245</A>&nbsp;<BR /><BR /><BR /></P> Fri, 08 Apr 2022 20:44:44 GMT ragedsparrow 2022-04-08T20:44:44Z How to view host disk encryption status https://community.splunk.com/t5/Splunk-Search/How-to-view-host-disk-encryption-status/m-p/593161#M206456 <P>I need a query to view disk encryption (DAR) of all my hosts, be it Bit Locker, LUKS, etc.</P><P>index=* host=* | ???</P><P>Thank you in advance.</P> Fri, 08 Apr 2022 20:24:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-view-host-disk-encryption-status/m-p/593161#M206456 dfiore42 2022-04-08T20:24:03Z Re: How to view host disk encryption status https://community.splunk.com/t5/Splunk-Search/How-to-view-host-disk-encryption-status/m-p/593162#M206457 <P>Do you have data in splunk that denotes that the disk in encrypted?&nbsp; There are a few things to know here:</P><UL><LI>Where your data is stored (index)</LI><LI>What differentiates your data&nbsp; (sourcetype, source, etc)</LI><LI>Is your data that you need being monitored?&nbsp;</LI></UL><P>Specifically for BitLocker, those are included in Windows Events.&nbsp; This answer may be helpful in finding where they are:&nbsp;<A href="https://community.splunk.com/t5/Getting-Data-In/Retrieving-Windows-Event-logs-with-hyphens-in-the-name/m-p/441245" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Retrieving-Windows-Event-logs-with-hyphens-in-the-name/m-p/441245</A>&nbsp;<BR /><BR /><BR /></P> Fri, 08 Apr 2022 20:44:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-view-host-disk-encryption-status/m-p/593162#M206457 ragedsparrow 2022-04-08T20:44:44Z