Software Installation and Uninstallation Alert configuration

[Issac08]

Hi All,

   We  are planning to enable Software Installation and Uninstall alerts for windows and Linux servers, What type of rules i should make ...and in what all use cases this alerts must trigger. i:e We have some approved sw from our end we don't want all these alerts. 

[EricPartington]

I would research the windows and unix events that are triggered during software installations and make sure your enterprise logging policy has those enabled.  once you get the events you can make your alerts and reports based on allowed product whitelists/blacklists.

Without the correct event types coming into the SIEM you wont be able to start writing your alerts/reports.

[Issac08]

can you please some basic events 

[Issac08]

Any help?

[EricPartington]

Does your logging policy on Windows cover these events?

http://eventlogs.blogspot.com/2007/11/tracking-software-installation-and.html

if so I would start with these event ID's and base your alerts on what is extracted from them.

to check

event.cat.name = 'Config.Software.Installed'

you might see events like this

or this

and build alerts based on what you want to alert on.