mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
40 lines
1.8 KiB
JSON
40 lines
1.8 KiB
JSON
{
|
|
"category": [
|
|
"Best Practices"
|
|
],
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-08-15",
|
|
"description": "Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.",
|
|
"detections": [
|
|
{
|
|
"detection_id": "1a77c08c-2f56-409c-a2d3-7d64617edd4f",
|
|
"name": "No Windows Updates in a time frame",
|
|
"type": "splunk"
|
|
}
|
|
],
|
|
"id": "9ef8d677-7b52-4213-a038-99cfc7acc2d8",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-15",
|
|
"name": "Monitor for Updates",
|
|
"narrative": "It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\n\nSearches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\n\nMicrosoft releases updates for Windows systems on a monthly cadence. They should be installed as soon as possible after following internal testing and validation procedures. Patches and updates for other systems or applications are typically released as needed.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://learn.cisecurity.org/20-controls-download"
|
|
],
|
|
"spec_version": 2,
|
|
"usecase": "Compliance",
|
|
"version": "1.0"
|
|
}
|