mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
41 lines
1.6 KiB
YAML
41 lines
1.6 KiB
YAML
category:
|
|
- Best Practices
|
|
channel: ESCU
|
|
creation_date: '2017-08-15'
|
|
description: Monitor your enterprise to ensure that your endpoints are being patched
|
|
and updated. Adversaries notoriously exploit known vulnerabilities that could be
|
|
mitigated by applying routine security patches.
|
|
detections:
|
|
- detection_id: 1a77c08c-2f56-409c-a2d3-7d64617edd4f
|
|
name: No Windows Updates in a time frame
|
|
type: splunk
|
|
id: 9ef8d677-7b52-4213-a038-99cfc7acc2d8
|
|
maintainers:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
modification_date: '2017-09-15'
|
|
name: Monitor for Updates
|
|
narrative: 'It is a common best practice to ensure that endpoints are being patched
|
|
and updated in a timely manner, in order to reduce the risk of compromise via a
|
|
publicly disclosed vulnerability. Timely application of updates/patches is important
|
|
to eliminate known vulnerabilities that may be exploited by various threat actors.\
|
|
|
|
Searches in this analytic story are designed to help analysts monitor endpoints
|
|
for system patches and/or updates. This helps analysts identify any systems that
|
|
are not successfully updated in a timely matter.\
|
|
|
|
Microsoft releases updates for Windows systems on a monthly cadence. They should
|
|
be installed as soon as possible after following internal testing and validation
|
|
procedures. Patches and updates for other systems or applications are typically
|
|
released as needed.'
|
|
original_authors:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
references:
|
|
- https://learn.cisecurity.org/20-controls-download
|
|
spec_version: 2
|
|
usecase: Compliance
|
|
version: '1.0'
|