mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
23 lines
1.6 KiB
YAML
23 lines
1.6 KiB
YAML
name: Previously Seen Running Windows Services - Update
|
|
id: 2e3bdd68-1863-46ee-81f8-87273eee7f1c
|
|
version: 5
|
|
creation_date: '2020-06-24'
|
|
modification_date: '2026-05-13'
|
|
author: David Dorsey, Splunk
|
|
status: production
|
|
description: This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached.
|
|
search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?<service>[-\(\)\s\w]+) service entered the (?<state>\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), `previously_seen_windows_services_forget_window`) | outputlookup previously_seen_running_windows_services'
|
|
how_to_implement: While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
|
|
known_false_positives: No false positives have been identified at this time.
|
|
references: []
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
security_domain: endpoint
|
|
custom_schedule:
|
|
cron_schedule: 55 * * * *
|
|
earliest_time: -70m@m
|
|
latest_time: -10m@m
|
|
schedule_window: auto
|