Endpoint & OS Patch Compliance Queries

📌 Purpose

This document provides approved and compliant Splunk query patterns for retrieving endpoint data, particularly for Windows patch compliance.

---

✅ Approved Data Sources

Indexes & Lookups

• | inputlookup ux_nodes_lookup

  • Description: Lookup table containing endpoint inventory details.
  • Key Fields: host, os_version, last_seen, patch_status.

• | search index=getIndexConfidentialData source="monitor.endpoint.info"

  • Description: Stores detailed telemetry from endpoints for UXM monitoring.
  • Key Fields: hostname, os, os_build, patch_level, status.

---

🔑 Field Definitions

Field Name	Source	Description
host	ux_nodes_lookup	Endpoint hostname
os_version	ux_nodes_lookup or monitor.endpoint.info	OS version string (e.g., 10.0.22000)
patch_status	ux_nodes_lookup	Indicates if system is patched/unpatched
os	monitor.endpoint.info	OS type and family (e.g., Windows 11, macOS)
patch_level	monitor.endpoint.info	Patch baseline version

---

✅ SPL Query Examples

1. All Endpoints from Lookup

| inputlookup ux_nodes_lookup
| fields host os_version patch_status last_seen