Updates dashboard
The Updates dashboard provides additional insight into systems by showing systems that are not updated. It is a good idea to look at this dashboard on a monthly basis to ensure systems are updating properly.
Dashboard filters
Use the filters to refine which events are shown.
| Filter by | Description |
|---|---|
| Time range | Select the time range to represent. |
| Business unit | A group or department classification for the identity. |
| Category | Filter based on the categories to which the malware belongs. |
| Destination | Host name of the system. |
| Show only systems that should update | Select true to filter by systems categorized as should_update=true in the Asset table or false to filter by systems categorized as should_update=false in the Asset table. See Configure the new asset or identity list in Splunk Enterprise Security in Administer Splunk Enterprise Security for more about asset configuration. |
Key indicators
Displays the metrics relevant to the dashboard sources over the past 48 hours. Key indicators represent summary information and appear at the top of the dashboard. See Key indicators in Splunk Enterprise Security.
| Key indicator | Description |
|---|---|
| Not updating | Systems that have not been updated, sorted by the number of days for which they have not been updated. |
| Available updates | The total number of updates available for the environment. |
| Installed updates | The total number of updates installed. |
Dashboard panels
Following table displays the panels in this dashboard:
| Panel | Description |
|---|---|
| Top systems needing updates | Displays all the systems that need to install the updates. Administrators sometimes disable automatic updates to expedite a restart and can forget to re-enable the process. |