Splunk Search

Trying to search Windows Patches?

Nmorris22
Engager

I am new to Splunk and I am trying to determine how to search for when "When a windows host was last patched"?

Labels (3)

marceloalejandr
Path Finder

In doing a little looking into this topic, I came across a relevant and interesting article.   Please see URL for details:  https://www.linkedin.com/pulse/using-splunk-monitor-windows-patch-status-ibrahim-kunduraci

We have not yet implemented the article's solution but interested if anyone has implemented it or something similar.   

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Nmorris22 please let us know more details.. which windows apps /TA'sfor Splunk you have installed? (windows app for infrastructure for Splunk, for example)...(on splunk GUI, "manage apps" will give you list of all apps installed on ur splunk).

data onboarded or not yet?.. 

or, simply search for an active windows host.. from the events list, you can work reverse ideas as well. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

marceloalejandr
Path Finder

Aloha,

In doing a little looking into this topic, I came across a relevant and interesting article.   Please see URL for details:  
https://www.linkedin.com/pulse/using-splunk-monitor-windows-patch-status-ibrahim-kunduraci

We have not yet implemented the article's solution which includes installing Splunk Add-on for MS Windows and Splunk App for Windows Infrastructure.   Has anyone implemented this solution or something similar yet?   

Thanks for the feedback and any insight.  

0 Karma

Nmorris22
Engager

The add-in's I have is the MS Windows AD Objects and I believe the data is onboarded. As of right now I have just been trying to use the search function under search and reporting to pull the events list.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...