Splunk Search

Find change in installed antivirus software version

ASierra
Explorer

Starting our journey into Splunk and need some help.

I am trying to send and alert when a new version of antivirus is installed on our machines. I am monitoring the application windows event log, so it would be something like grab the version from 20 minutes ago in the logs and if different than current version send the alert.

"Message=Windows Installer installed the product. Product Name: Antivirus Software. Product Version: 1.0.0.000.1. Product Language: 001. Manufacturer: Antivirus. Installation success or error status: 0"

Any ideas on how to start this search?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ASierra,

what the frequency of this alert?

if it's e.g. every day, you could run a search like this:

index=your_index "Windows Installer installed the product" earliest=-24h
| rex "Product Name: (?<Product_Name>.+)\. Product Version: (?<Product_Version>.+)\. Product Language"
| stats dc(Product_Version) AS dc_pv BY host Product_Name
| where dc_pv>1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...