Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Show all event in the window patch dashboard #648

Merged
merged 2 commits into from
Oct 4, 2024
Merged

Show all event in the window patch dashboard #648

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
46eabc9
Show all event in the window patch dashboard
mahirchavda Oct 3, 2024
90e42e8
two panel for latest and all events
mahirchavda Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 4 additions & 16 deletions cyences_app_for_splunk/default/data/ui/views/cs_windows_patch.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,14 +73,8 @@
<search>
<query>`cs_wineventlog_system` host="$host$" $tkn_host_filter$ $tkn_patch_numbers$ EventCode=19 SourceName="Microsoft-Windows-WindowsUpdateClient" NOT "Microsoft Endpoint Protection" NOT "Microsoft Defender Antivirus"
| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "")
| append
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We used to have this to detect which of the machine don't have any patching events. (lookup)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can use eventstats command (inside appendpipe) to check if there is any events from host is present or not. And if not present then add additional events.

| eval event_from="event"
| append [| inputlookup <lookup-name> | eval event_from="lookup"]
| appendpipe [| eventstats count(eval(if(event_from="event", 1, null()))) as no_of_events_from_host by host 
| eval no_event="No Update Event Found"
| where no_of_events_from_host=0]

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think creating separate dashboard for history would be better. The existing one was just doing that.

[| inputlookup all_windows_hosts.csv
| search host="$host$" $tkn_host_filter$
| eval no_event="No Update Event Found"]
| stats first(message) as message, first(no_event) as no_event by host
| eval message = if(isnull(message), no_event, message)
| table host message
| sort host</query>
| table _time host message
| sort -_time host</query>
<earliest>$timerange.earliest$</earliest>
<latest>$timerange.latest$</latest>
</search>
Expand All @@ -100,14 +94,8 @@
<search>
<query>`cs_wineventlog_system` host="$host$" $tkn_host_filter$ $tkn_patch_numbers$ EventCode=19 ("Microsoft Endpoint Protection" OR "Microsoft Defender Antivirus")
| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "")
| append
[| inputlookup all_windows_hosts.csv
| search host="$host$" $tkn_host_filter$
| eval no_event="No Update Event Found"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This part will add additional info for the host which does not have any update event.

| stats first(message) as message, first(no_event) as no_event by host
| eval message = if(isnull(message), no_event, message)
| table host message
| sort host</query>
| table _time host message
| sort -_time host</query>
<earliest>$timerange.earliest$</earliest>
<latest>$timerange.latest$</latest>
</search>
Expand Down