topic Re: Splunk query to find browsers installed on a machine in Splunk Search

Splunk query to find browsers installed on a machine

Roy_9 — Mon, 03 Jun 2024 16:19:38 GMT

Hi,

can someone help me with splunk search to identify browsers installed on a machine, im looking for a specific field where i can capture this data.

thanks

Re: Splunk query to find browsers installed on a machine

ITWhisperer — Mon, 03 Jun 2024 16:40:36 GMT

What data do you have ingested into Splunk?

Re: Splunk query to find browsers installed on a machine

Roy_9 — Mon, 03 Jun 2024 16:42:26 GMT

@ITWhisperer we have splunk add-on windows deployed on all machines.

Re: Splunk query to find browsers installed on a machine

ITWhisperer — Mon, 03 Jun 2024 16:47:33 GMT

OK so what information have managed to ingest into Splunk from them? Essentially, you can only query information which has been ingested (with a few exceptions).

Re: Splunk query to find browsers installed on a machine

PickleRick — Tue, 04 Jun 2024 08:17:30 GMT

Extending @ITWhisperer 's answer - unless you have a third-party solution (some form of asset inventory software or even your own scripted input listing installed software), Splunk on its own cannot tell you since it only works on the data you give it. So by default you can only pull what your Windows machine produces (event logs, maybe some log files). So if you can find this info in what Windows report on its own - good, you can use it. But I don't recall that it does.