Splunk Enterprise Security

Locate Missing Software

New Member

I am trying to run a search to locate specific missing software. I'm hitting a roadblock. I don't want to have to pull all software and do an extraction. I just want to be able to see what devices are missing our AV applications. Any thoughts?

Thanks.

0 Karma
1 Solution

Builder

As @richgalloway said, you cannot look for some that's not there

However, you can look for things that are some places and not others

You might do something like this on a periodic basis (of course, use whatever field names fit your environment):

index=ndx sourcetype=srctp hostname=* appname=*
| stats count by hostname
| fields - count
| outputlookup allendpointswithsoftware.csv

Now you have a list of all endpoints that have installed software of any kind.

Now get a list of all endpoints that have the AV software:

index=ndx sourcetype=srctp hostname=* appname="my-AV-name"
| stats count by hostname
| fields - count
| outputlookup allendpointswithavtools.csv

Then do a diff between them:

| inputlookup allendpointswithsoftware.csv
| search NOT
[ | inputlookup allendpointswithavtools.csv ]

This will give you all the hosts that weren't in the AV-is-installed list, but are known in Splunk

View solution in original post

0 Karma

Builder

As @richgalloway said, you cannot look for some that's not there

However, you can look for things that are some places and not others

You might do something like this on a periodic basis (of course, use whatever field names fit your environment):

index=ndx sourcetype=srctp hostname=* appname=*
| stats count by hostname
| fields - count
| outputlookup allendpointswithsoftware.csv

Now you have a list of all endpoints that have installed software of any kind.

Now get a list of all endpoints that have the AV software:

index=ndx sourcetype=srctp hostname=* appname="my-AV-name"
| stats count by hostname
| fields - count
| outputlookup allendpointswithavtools.csv

Then do a diff between them:

| inputlookup allendpointswithsoftware.csv
| search NOT
[ | inputlookup allendpointswithavtools.csv ]

This will give you all the hosts that weren't in the AV-is-installed list, but are known in Splunk

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can't search for something that's not there. See https://www.duanewaddle.com/proving-a-negative/
The only way to find who doesn't have something is to subtract those that do have it from the list of everyone.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!