Thanks guys for your suggestion, which I tried out yesterday.
I managed to create the custom def, however, there are two obstacles:
- My Test Server is not being scanned for this custom def for some reason. My custom def shows up in the "All definitions not scanned" section. I assume I did something wrong with the detection rule, but how can I tell the custom def to always scan, regardless of what is installed? I tried to use a query filter in the detection logic that scans for "Any Windows Server", but obviously that didn't work. Any ideas?
- The date that is being "stamped" has different formats on different servers. I assume it's because some older servers still have a default regional setting of german language. Is there anything I could add to the command to determine the format for all, say MMDDYYYY or something like that?
Again, thanks for supporting me!
Regards,
Sam