Getting Data In

Rule to get alerted when a specific windows machine comes online

New Member

I'm trying to get a alert out when ever a specific windows machine comes online. I have created a lookup table for machines ( machines for which there was a IDS alert and I can't check that as its offline) and what to get alerted whenever they come online.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You could use your monitoring solution, such as Nagios, to write a log entry when a server comes online. Alternatively, you can write a cron job (or scheduled task in windows) to check the list of machines and have that program write to Splunk read logs that the machine has come online. You could create the list to check from a lookup generated in Splunk, manually, or even from your IDS to drive the process.

If that system uses a Splunk Forwarder, you can check to see when it last connected with:

index=_internal "statusee=TcpInputProcessor" source="/opt/splunk/var/log/splunk/metrics.log" sourceHost=yourhost
Jesse Trucks
Minister of Magic

Revered Legend

You can try options mentioned in below link to be able to ping a server (from your lookup) and based on the result of ping, you can set your alert.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...