Splunk Search

How to write query for Windows remote desktop connection?

afraanajam
Loves-to-Learn Lots

I am looking for Splunk query to find out Windows remote desktop service status and also to find to port 3389 is listening on server..

Labels (1)
0 Karma

PickleRick
Ultra Champion

Question is what kind of data you have in your Splunk.

Remember that Splunk is a data analytics solution, not an EDR, A/V, web-gateway or anything else.

So in order to find some information in it you first have to ingest the data. In other words - if you're not monitoring the system you want to query Splunk about, you won't get any information because Splunk doesn't know anything about.

0 Karma

afraanajam
Loves-to-Learn Lots

Any advice pls.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...