Solved: Help with Splunk alert to identify software remova...

radparik · ‎05-25-2021

Hello,

I am trying to figure out how to monitor for a successful removal/installation of a software in the environment (mainly MSI) using Splunk. Does anyone know how I can go about this?

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

radparik · ‎05-26-2021

Thank you!

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

Help with Splunk alert to identify software removal/installation

alert condition

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

.conf24 | Personalize your .conf experience with Learning Paths!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...