Splunk

No Windows Updates in a time frame

Last updated 2 days ago on 2026-07-17

About

The following analytic identifies Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. It leverages the 'Update' data model in Splunk, specifically looking for the latest 'Installed' status events from Microsoft Windows. This activity is significant for a SOC because endpoints that are not regularly patched are vulnerable to known exploits and security vulnerabilities. If confirmed malicious, this could indicate a compromised endpoint that is intentionally being kept unpatched, potentially allowing attackers to exploit unpatched vulnerabilities and gain unauthorized access or control.

Platform: Splunk
Tags: Data Source: SplunkDomain: ApplicationRule Type: QueryOS: Any
Severity: medium
Risk Score: 47
False Positives: No false positives have been identified at this time.
Source: View on GitHub(external, opens in a new tab or window)

Definition

Rule Language: SPL
Rule Type: query

✄𐘗text code block:
✄𐘗| tstats `security_content_summariesonly` max(_time) as lastTime FROM datamodel=Updates
  WHERE Updates.status=Installed Updates.vendor_product="Microsoft Windows"
  BY Updates.dest Updates.status Updates.vendor_product
| rename Updates.dest as Host
| rename Updates.status as "Update Status"
| rename Updates.vendor_product as Product
| eval isOutlier=if(lastTime <= relative_time(now(), "-60d@d"), 1, 0)
| `security_content_ctime(lastTime)`
| search isOutlier=1
| rename lastTime as "Last Update Time",
| table Host, "Update Status", Product, "Last Update Time"
| `no_windows_updates_in_a_time_frame_filter`

View this rule on Splunk

This rule was sourced from the official Splunk public repository. View the original rule on GitHub(external, opens in a new tab or window).