All Apps and Add-ons

Splunk Security Essentials: Scheduled Tasks

BluFalcon
Engager

I hope this is the right place to post this if not please let me know where to post it. There are multiple use-cases for Task Scheduler in the SSE app, my question pertains to all that are based on EventID=4698

None of these searches seem to work in my environment out of box, I checked and my Windows TA is up to date. Not sure if there is another TA required? Here is on as an example and how I fixed it:

`wineventlog_security` EventCode=4698
| xmlkv Message
| search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*")
| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `winevent_scheduled_task_created_within_public_path_filter`

 

To fix this query I ended up changing line 2 to:
| xmlkv TaskContent

And line 4 to:
| stats count min(_time) as firstTime max(_time) as lastTime by dest, TaskName, Command, Author, Enabled, Hidden, Arguments

I dont know if I am missing something or if this is broken out of the box, if so is there somewhere to report this?

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

First, make sure you have the most recent version of the app.  If the errors still exist, file a case with Splunk since that is a supported app.  See https://splunkcommunities.force.com/customers/apex/SubmitCase

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

BluFalcon
Engager

@richgalloway thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

First, make sure you have the most recent version of the app.  If the errors still exist, file a case with Splunk since that is a supported app.  See https://splunkcommunities.force.com/customers/apex/SubmitCase

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...