Splunk Guru

itsmevic

<div>
<div class="content wysiwyg-content">
In an effort to ensure machines are syncing correctly across our network, I was able to figure out the correct query to ask Tanium to pull NTP times across the network on all Windows systems. &nbsp;Now I'd like to target another search and pull NTP information from Linux machines too. &nbsp; Windows stores NTP info in the registry, where would Linux store it? <br />
<br />

<pre><code id="code-10-29170363-1">GET
  Computer Name
  and
  Registry Value Data[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters,NtpServer]
FROM all machines WITH
  Operating System contains windows</code></pre>
</div>
</div>


In an effort to ensure machines are syncing correctly across our network, I was able to figure out the correct query to ask Tanium to pull NTP times across the network on all Windows systems.  Now I'd like to target another search and pull NTP information from Linux machines too.   Windows stores NTP info in the registry, where would Linux store it? 

(CODE)

Tanium:  Pull NTP information from LInux

Linux is a UNIX-like open source operating system with hundreds of distinct distributions, including: Fedora, openSUSE, Ubuntu, Debian, Slackware, Gentoo, CentOS, and Arch Linux. Linux is generally associated with web and database servers, but has become popular in many niche industries and applications.

Linux

This topic area includes legacy versions of Windows prior to Windows 2000: Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions including Windows Mobile.

Windows OS

Networking is the process of connecting computing devices, peripherals and terminals together through a system that uses wiring, cabling or radio waves that enable their users to communicate, share information and interact over distances. Often associated are issues regarding operating systems, hardware and equipment, cloud and virtual networking, protocols, architecture, storage and management.