Splunk Enterprise Security

Windows Data Mapping to the Update Data Model

dokaas_2
Communicator

I'm in the process of implementing Splunk ES.  We are using the Splunk_TA_windows and use the generate_windows_update_logs.ps1script to generated update log files.  However, that file looks useless in populating the Update data model used in ES. 

Is there another script that will produce suitable output from Windows OS to populate the Update data model that can be used by ES?

 

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...