Solved: Re: Help with Splunk alert to identify software re...

radparik · ‎05-25-2021

Hello,

I am trying to figure out how to monitor for a successful removal/installation of a software in the environment (mainly MSI) using Splunk. Does anyone know how I can go about this?

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

radparik · ‎05-26-2021

Thank you!

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

Help with Splunk alert to identify software removal/installation

alert condition

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

Join the Conversation