Splunk Search

How to write query for Windows remote desktop connection?

afraanajam
Loves-to-Learn Everything

I am looking for Splunk query to find out Windows remote desktop service status and also to find to port 3389 is listening on server..

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Question is what kind of data you have in your Splunk.

Remember that Splunk is a data analytics solution, not an EDR, A/V, web-gateway or anything else.

So in order to find some information in it you first have to ingest the data. In other words - if you're not monitoring the system you want to query Splunk about, you won't get any information because Splunk doesn't know anything about.

0 Karma

afraanajam
Loves-to-Learn Everything

Any advice pls.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...