Installation

software uninstalled

riqbal47010
Path Finder

Dear All,

how can I know that if someone uninstall anti virus solution on windows server or client. can we get that logs with windows TA ?

Tags (1)
0 Karma
1 Solution

jacobpevans
Motivator

Greetings @riqbal47010,

Yes, this is possible with the Windows TA. See documentation below. Of particular interest to you is WinEventLog in the third link. You can also check out the inputs.conf in the default directory after installing the add-on (note that all inputs are disabled by default - you can copy stanzas into a new inputs.conf in the local directory in order to enable Event Log monitoring). 11724 is the Windows Application Event Code that documents uninstallations.

https://splunkbase.splunk.com/app/742/#/details
https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows
https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @riqbal47010,

Yes, this is possible with the Windows TA. See documentation below. Of particular interest to you is WinEventLog in the third link. You can also check out the inputs.conf in the default directory after installing the add-on (note that all inputs are disabled by default - you can copy stanzas into a new inputs.conf in the local directory in order to enable Event Log monitoring). 11724 is the Windows Application Event Code that documents uninstallations.

https://splunkbase.splunk.com/app/742/#/details
https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows
https://docs.splunk.com/Documentation/WindowsAddOn/6.0.0/User/Configuration

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...