Splunk Search

How to create a weekly report comparing changes in Domain Controllers' Operating System Type and Version?

DanAlexander
Communicator

Hello All,

I would like to be able to track down any and every configuration change on our monitored DC, AD etc.

I need to be able to see those changes in comparison fashion - week to week.

I aim to create an auto report that would run every Monday for instance and let us know of any changes being introduced on the monitored assets (focusing on OS type; Linux, Windows and their previous and current versions).

Thank you All in advance!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

usually this add-on is always present in ES installations, so you shouldn't have problems and should already have it.

At the same time, usually, on ES machines aren't installed other apps than ES and its add-ons (between them also TA-Windows), but if your custom app isn't so heavy, it shouldn't bring too much load

Without the data ingested with this add-on isn't possible to have the data to use for this check.

Answering to your last question: these informations aren't extracted from WinEventLog but using some script in the TA, so it's very difficoult to have them without the TA.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

you can installa a Universal Forwarder on your DCs and deploy the Splunk-TA_Windows (https://splunkbase.splunk.com/app/742/)

in this TA you can enable the acquisition of all configuration informations and then check if there's some change.

Ciao.

Giuseppe

0 Karma

DanAlexander
Communicator

Morning @gcusello 

I should have mentioned that we do have UFs installed on the assets and we have logs coming into Splink. 

I need a search query, please

Thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

if you enabled the input stanzas in TA-Windows, you should be able to see all panels of this dashboard that displays all the server information:

<form>
  <label>Hardware and Software Details: Windows Servers</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host">
      <label>Server</label>
      <prefix>host="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search>
        <query>index=windows sourcetype=WinHostMon Type=Computer | eval host=upper(host) | dedup host | sort host | table host</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>HostName</title>
      <html>
      <h3 align="center">
        <strong> <font size="10">Server<img src="/static/app/infrastructure_monitoring/Windows_logo.png" style="height:100px;border:0;"/>
            </font>
          </strong>
        </h3>
    </html>
      <single>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Computer $host$
            | eval host=upper(host)
            | dedup host 
            | sort host
            | table host</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Model</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Computer $host$ 
            | eval host=upper(host)
            | dedup host 
            | lookup Server host OUTPUT IP Tipologia
            | table Manufacturer Model IP Tipologia</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
    <panel>
      <title>Operative System</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=OperatingSystem $host$
            | eval host=upper(host)
            | dedup host 
            | sort host 
            | table OS Version ServicePack BuildNumber SerialNumber InstallDate LastBootUpTime
            | eval 
               InstallDate=strftime(strptime(InstallDate,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S"),
               LastBootUpTime=strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h3 align="center">
        <strong> <font size="6">Hardware</font>
          </strong>
        </h3>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>CPU</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Processor $host$ 
            | eval host=upper(host)
            | dedup host 
            | sort host
            | table Name NumberOfCores Architecture ClockSpeedMHz Manufacturer
            | rename name AS CPU  Manufacturer AS "CPU Manufacturer"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
    <panel>
      <title>RAM</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=OperatingSystem $host$
            | eval host=upper(host)
            | dedup host 
            | sort host 
            | eval 
              FreePhysicalMemoryGB=FreePhysicalMemoryKB/1024/1024,
              FreeVirtualMemoryGB=FreeVirtualMemoryKB/1024/1024,
              TotalPhysicalMemoryGB=TotalPhysicalMemoryKB/1024/1024,
              TotalVirtualMemoryGB=TotalVirtualMemoryKB/1024/1024,
              Virtual_mem_free_percent=FreeVirtualMemoryKB/TotalVirtualMemoryKB*100
            | table FreePhysicalMemoryGB TotalPhysicalMemoryGB mem_free_percent FreeVirtualMemoryGB TotalVirtualMemoryGB Virtual_mem_free_percent  
            | rename FreePhysicalMemoryGB AS "Free Physical Memory" TotalPhysicalMemoryGB AS "Total Physical Memory" mem_free_percent AS "Free Physical Memory%" FreeVirtualMemoryGB AS "Free Virtual Memory" TotalVirtualMemoryGB AS "Total Virtual Memory" Virtual_mem_free_percent AS "Free Virtual Memory%"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <format type="number" field="FreeVirtualMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="FreePhysicalMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="TotalVirtualMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="TotalPhysicalMemoryGB">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="FreePhysicalMemory%">
          <option name="unit">%</option>
        </format>
        <format type="number" field="FreeVirtualMemory%">
          <option name="unit">%</option>
        </format>
        <format type="number" field="Free Physical Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Total Physical Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Physical Memory%">
          <option name="unit">%</option>
        </format>
        <format type="number" field="Free Virtual Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Total Virtual Memory">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Virtual Memory%">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
    <panel>
      <title>Disks</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Disk $host$
            | eval host=upper(host)
            | dedup Name 
            | sort Name 
            | eval 
              storage=storage/1024,
              storage_free=storage_free/1024,
              storage_used=storage_used/1024,
              storage_free_perc=storage_free/storage*100
            | table Name DriveType FileSystem storage storage_free storage_used storage_free_perc
            | rename storage AS "Disk Space" storage_free AS "Free Disk Space" storage_used AS "Used Disk Space" storage_free_perc AS "Free Disk Space %"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Used Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space %">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
    <panel>
      <title>Network Adapters</title>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=NetworkAdapter $host$
            | eval host=upper(host)
            | dedup Name 
            | sort Name 
            | table Name Manufacturer ProductName</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Used Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space %">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h3 align="center">
        <strong> <font size="6">Software</font>
          </strong>
        </h3>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Applications</title>
      <input type="text" token="appname">
        <label>Name</label>
        <default>*</default>
        <prefix>Name="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Application $host$ $appname$
            | eval host=upper(host)
            | dedup Name 
            | sort Name 
            | eval InstallDate=strftime(strptime(InstallDate,"%Y%m%d"),"%d/%m/%Y")
            | table Name Vendor Version SerialNumber InstallDate InstallLocation</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Drivers</title>
      <input type="text" token="drivname">
        <label>Name</label>
        <default>*</default>
        <prefix>DeviceID="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Driver $host$ $drivname$
            | eval host=upper(host)
            | dedup DeviceID 
            | sort DeviceID 
            | table DeviceID DriverVersion</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="number" field="Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Used Disk Space">
          <option name="unit">GB</option>
        </format>
        <format type="number" field="Free Disk Space %">
          <option name="unit">%</option>
        </format>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h3 align="center">
        <strong> <font size="6">Run</font>
          </strong>
        </h3>
    </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Processes</title>
      <input type="text" token="procname">
        <label>Name</label>
        <default>*</default>
        <prefix>Name="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Process $host$ $procname$
            | eval host=upper(host)
            | dedup Name
            | sort Name
            | eval StartTime=strftime(strptime(StartTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H.%M.%S")
            | table Name Path ProcessId StartTime</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <title>Services</title>
      <input type="text" token="servname">
        <label>Name</label>
        <default>*</default>
        <prefix>Name="</prefix>
        <suffix>"</suffix>
      </input>
      <table>
        <search>
          <query>index=windows sourcetype=WinHostMon Type=Service $host$ $servname$
            | eval host=upper(host)
            | dedup Name 
            | sort Name
            | table Name DisplayName Description Path Started StartMode State</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

 Then to map differences, you should make a stats dc for each information, e.g.

index=windows sourcetype=WinHostMon Type=OperatingSystem $host$
| stats 
   dc(TotalPhysicalMemoryKB) AS TotalPhysicalMemoryKB_count 
   dc(TotalVirtualMemoryKB) AS TotalVirtualMemoryKB_count
   BY host
| where TotalPhysicalMemoryKB_count>1 OR TotalVirtualMemoryKB_count>1

Ciao.

Giuseppe

0 Karma

DanAlexander
Communicator

Hi @gcusello 

Thank you for the feedback. All that makes lots of sense.

However, I wanted to know if we can do simple stats without the Add-on? We have a restricted ability to install add-ons to our ES instance. Are they any Win Event Logs that can generate those figures by a chance, please?

D

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

usually this add-on is always present in ES installations, so you shouldn't have problems and should already have it.

At the same time, usually, on ES machines aren't installed other apps than ES and its add-ons (between them also TA-Windows), but if your custom app isn't so heavy, it shouldn't bring too much load

Without the data ingested with this add-on isn't possible to have the data to use for this check.

Answering to your last question: these informations aren't extracted from WinEventLog but using some script in the TA, so it's very difficoult to have them without the TA.

Ciao.

Giuseppe

DanAlexander
Communicator

Hi,

Thanks for the advice, @gcusello. Much appreciated!

Ciao

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...