Getting Data In

How to query a Windows server for a list of computer certificates and forward this to an index?

msudhindra
Path Finder

Hello!

Our environment has a large number of Windows servers, and each of those servers gets a Computer certificate from an Enterprise PKI infrastructure.

Is there a way we can query the computer certificate stored on a Windows computer for a list of certificates issued, along with the expiration date for the certificate, and pull the data into an index?

Our Windows servers already have Universal forwarders installed on them.

Thanks in advance
Madan Sudhindra

0 Karma

woodcock
Esteemed Legend

You can use one of the methods to query your certificates here:

http://blogs.technet.com/b/heyscriptingguy/archive/2013/03/05/use-powershell-to-find-certificates-th...

Once you settle on a powershell command string, you can install this app that allows you to use any powershell command string as a Scripted Input as the Powershell Modular Input:

https://splunkbase.splunk.com/app/1477/

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...