Updates dashboard

The Updates dashboard provides additional insight into systems by showing systems that are not updated. It is a good idea to look at this dashboard on a monthly basis to ensure systems are updating properly.

Dashboard filters

Use the filters to refine which events are shown.

Filter by Description
Time range Select the time range to represent.
Destination Filter by the host name of the system.
Update status Filter by the available, installed, or restart status of the systems.
Category Filter based on the categories to which the malware belongs.
Business Unit A group or department classification for the identity.
Show only systems that should update Select true to filter by systems categorized as should_update=true in the Asset table or false to filter by systems categorized as should_update=false in the Asset table. See Configure the new asset or identity list in Splunk Enterprise Security in Administer Splunk Enterprise Security for more about asset configuration.
Signature Filter by the human-readable name or specific identifier of a discrete software update, patch (such as a Microsoft Knowledge Base KB number), or definition file/rule supplied by a vendor.

Dashboard panels

Panel Description
Updates search Dedicated ad-hoc and drilldown queries to investigate software updates, patches, and package statuses across your monitored devices.
Updates events Normalized log data concerning software patches, operating system updates, and package installations or attempts on endpoints.
Top updates needed A bar chart panel displaying the most frequently missing software updates or patches across your environment.
Systems not updating Systems that have not been updated, sorted by the number of days for which they have not been updated.
Update service start mode anomalies Highlights all systems where the automatic update startup task or service has been turned off.