Splunk Search

How to create an alert for when McAfee services are stopped for 1 hour?

ravisplunksap
New Member

Hi All,

I want to create an alert for McAfee services stopped for the Windows hosts. Meanwhile every time McAfee services entered in to running state frequently. So I want to create a search that if the McAfee service is in a stopped state at least for 1 hour (i.e. it shouldn't go to entered state within this 1 hr). So, i have created below search to trigger an alert:

index=*windows EventCode=7036 host_status="Live" Message="The McAfee McShield service entered the stopped state." | transaction Message maxspan=60min maxpause=1min | table _time host host_status Message EventCode tic_customer

Is this the right method or should I modify this search?

Please assist here.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your query looks for the stopped state, but not the running state so you'll not find the services that have restarted. Try this.

index=*windows EventCode=7036 host_status="Live" (Message="The McAfee McShield service entered the stopped state." OR Message="The McAfee McShield service entered the running state.") | dedup host | where _time < relative_time(now(), "-1h") | where  Message="The McAfee McShield service entered the stopped state." | table _time host host_status Message EventCode tic_customer
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...