-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Show all event in the window patch dashboard #648
Conversation
@@ -73,14 +73,8 @@ | |||
<search> | |||
<query>`cs_wineventlog_system` host="$host$" $tkn_host_filter$ $tkn_patch_numbers$ EventCode=19 SourceName="Microsoft-Windows-WindowsUpdateClient" NOT "Microsoft Endpoint Protection" NOT "Microsoft Defender Antivirus" | |||
| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "") | |||
| append |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We used to have this to detect which of the machine don't have any patching events. (lookup)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can use eventstats command (inside appendpipe) to check if there is any events from host is present or not. And if not present then add additional events.
| eval event_from="event"
| append [| inputlookup <lookup-name> | eval event_from="lookup"]
| appendpipe [| eventstats count(eval(if(event_from="event", 1, null()))) as no_of_events_from_host by host
| eval no_event="No Update Event Found"
| where no_of_events_from_host=0]
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think creating separate dashboard for history would be better. The existing one was just doing that.
| append | ||
[| inputlookup all_windows_hosts.csv | ||
| search host="$host$" $tkn_host_filter$ | ||
| eval no_event="No Update Event Found"] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This part will add additional info for the host which does not have any update event.
No description provided.