Monitoring Splunk

Monitoring Symantec client for old virus definitions

coolgagan13
New Member

Is it possible to monitor below 2 situations via SEPM logs forwarded to Splunk via externla logging feature on SEPM console :

  1. Virus definitions x days old - If we want to alert on machines which have Virus definitions X days old? This would help administrators look in to possible issues.

  2. Components not function properly - For example auto protect not functioning. This should be reported and alerted.

Thanks,
Amar

Tags (2)
0 Karma

kylehillvt
New Member

Making another pass at the same goals and thus came across your post. What we did initially was to feed Splunk files with our machine inventories and then monitored the virus definition signature version off of each client (those paths seem to evolve as SEP updates or by 32 vs 64 bit unfortunately). Our saved search does left joins (so we always get a record for every machine on inventory) on the two and by default the earliest was -24h. So the outliers would have null signature versions.

The one other key detail was (with 4.2.. again revisiting) we had to use a separate inventory file vs Splunk's feature. That was the only way to perform the join vs a look-up at the time and it was easier to automate than automating the update of the CSV on the server.

-Kyle

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...