Getting Data In

Endpoint data Model Services Hashes, DLLs and executables

DanAlexander
Communicator

Hello Comunity

I am trying to identify the following.

What would be the best data source/s on Win Systems to gain visibility over the Services (which should be different from Processes) and their DLLs, executables, hashes, and paths?

The Endpoint Data Model requires fields related to the above:

https://docs.splunk.com/Documentation/CIM/5.2.0/User/Endpoint

Any help will be much appreciated!

Thank you.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...