Retrieved ProductName

[waschoo]

Hello,
There is a way to retrieved the "productname" ? (Ex: Windows 10 Enterprise)
Thank you :)

[jshcodes]

Hi @waschoo -

I believe what you're looking for is os_version. 😄

[waschoo]

Hi @jshcodes ,
No it's the "ProductName", the long version of os_version ;)
In Splunk:
event_simpleName=OSVersionInfo | table ComputerName ProductName

Ex:
os_version (falconpy) = Windows 10
ProductName (Splunk) = Windows 10 Enterprise

Thanks :)

[jshcodes]

Hi @waschoo -

I don't believe this value is returned, but you could do a lookup for it using os_build / build_number (or leveraging RTR to query the registry.) Data in event searches within the UI are already enriched whereas in the API result it is not present. (I'm assuming the reference above refers to our Investigate search within the console.)

[waschoo]

@jshcodes : Thank you ! This value (ProductName) is stored in Splunk but not available through the api, I will wait :)