All Apps and Add-ons

Splunk Security Essentials: Scheduled Tasks

BluFalcon
Engager

I hope this is the right place to post this if not please let me know where to post it. There are multiple use-cases for Task Scheduler in the SSE app, my question pertains to all that are based on EventID=4698

None of these searches seem to work in my environment out of box, I checked and my Windows TA is up to date. Not sure if there is another TA required? Here is on as an example and how I fixed it:

`wineventlog_security` EventCode=4698
| xmlkv Message
| search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*")
| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `winevent_scheduled_task_created_within_public_path_filter`

 

To fix this query I ended up changing line 2 to:
| xmlkv TaskContent

And line 4 to:
| stats count min(_time) as firstTime max(_time) as lastTime by dest, TaskName, Command, Author, Enabled, Hidden, Arguments

I dont know if I am missing something or if this is broken out of the box, if so is there somewhere to report this?

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

First, make sure you have the most recent version of the app.  If the errors still exist, file a case with Splunk since that is a supported app.  See https://splunkcommunities.force.com/customers/apex/SubmitCase

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

BluFalcon
Engager

@richgalloway thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

First, make sure you have the most recent version of the app.  If the errors still exist, file a case with Splunk since that is a supported app.  See https://splunkcommunities.force.com/customers/apex/SubmitCase

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...