Forum Discussion

LiliaF's avatar
LiliaF
Copper Contributor
Nov 04, 2022

OpenSSL version

Can I identify OpenSSL versions using Sentinel query? What kind of data type is needed?
KQL
GBushey's avatar
GBushey
Iron Contributor
Nov 07, 2022
What data are you looking to query? Your question is a bit open ended without knowing where the data would be coming from.
LiliaF's avatar
LiliaF
Copper Contributor
Nov 08, 2022

GBushey 

I am looking for a way to identify OpenSSL versions for different systems. More precisely I am trying to understand if I can find logs  that shows there are vulnerable OpenSSL versions as our customer is having troubles identifying those in their reports. Is it possible to create a query in Sentinel to check on which server OpenSSL is installed and in which version?

  • GBushey's avatar
    GBushey
    Iron Contributor
    Nov 08, 2022
    That would have to be done on a system-by-system basis. Without knowing what data each system is sending, it would not be possible to make this determination.
    • LiliaF's avatar
      LiliaF
      Copper Contributor
      Nov 08, 2022
      Thank you for the reply! Is there any common type of data that is sending such an information?
      • GBushey's avatar
        GBushey
        Iron Contributor
        Nov 08, 2022
        Not that I am aware of.

Resources