Trying to search Windows Patches?

[Nmorris22]

I am new to Splunk and I am trying to determine how to search for when "When a windows host was last patched"?

[marceloalejandr]

In doing a little looking into this topic, I came across a relevant and interesting article.   Please see URL for details:  https://www.linkedin.com/pulse/using-splunk-monitor-windows-patch-status-ibrahim-kunduraci

We have not yet implemented the article's solution but interested if anyone has implemented it or something similar.   

[inventsekar]

Hi @Nmorris22 please let us know more details.. which windows apps /TA'sfor Splunk you have installed? (windows app for infrastructure for Splunk, for example)...(on splunk GUI, "manage apps" will give you list of all apps installed on ur splunk).

data onboarded or not yet?.. 

or, simply search for an active windows host.. from the events list, you can work reverse ideas as well. 

[marceloalejandr]

Aloha,

In doing a little looking into this topic, I came across a relevant and interesting article.   Please see URL for details:  https://www.linkedin.com/pulse/using-splunk-monitor-windows-patch-status-ibrahim-kunduraci

We have not yet implemented the article's solution which includes installing Splunk Add-on for MS Windows and Splunk App for Windows Infrastructure.   Has anyone implemented this solution or something similar yet?   

Thanks for the feedback and any insight.  

[Nmorris22]

The add-in's I have is the MS Windows AD Objects and I believe the data is onboarded. As of right now I have just been trying to use the search function under search and reporting to pull the events list.