Alerting

How to determine and alert when there is a program installed on Windows Server 2008?

nickbijmoer
Path Finder

Hello guys I got a question,

How to determine when there is a program installed on Windows Server 2008?
I look at my logs, at application logs, but don't see when I install something like for example WinSCP.
I want these logs so i can alert in Splunk when someone installs a software product.

Anyone that can help me?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nickbijmoer
in Splunk_TA-Windows there is a scripted inputs (win_installed_apps.bat) that gives to you the list of all installed applications and the installation date.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...