Solved: Help with Splunk alert to identify software remova...

radparik · ‎05-25-2021

Hello,

I am trying to figure out how to monitor for a successful removal/installation of a software in the environment (mainly MSI) using Splunk. Does anyone know how I can go about this?

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

radparik · ‎05-26-2021

Thank you!

richgalloway · ‎05-25-2021

I believe you want events 11707 (install) and 11724 (remove).

---
If this reply helps you, Karma would be appreciated.

Help with Splunk alert to identify software removal/installation

alert condition

Introducing the Splunk Community Dashboard Challenge!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...