topic Re: the best way to collect Windows Defender logs? in Getting Data In

the best way to collect Windows Defender logs?

corti77 — Fri, 01 Sep 2023 13:53:02 GMT

Hi,

I need to collect the logs from Windows Defender and I was looking for an official app and I couldn't find one.

I read some people recommending "TA for Microsoft Windows Defender" but I see that it didn't get update since 2017.

Any other option more recent?

thanks.

Re: the best way to collect Windows Defender logs?

gcusello — Fri, 01 Sep 2023 17:00:59 GMT

Hi @corti77,

you can collect data from Windows Defender using the Splunk Add-On for Windows Security (https://splunkbase.splunk.com/app/6207) that's also accepted by Microsoft (https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/the-splunk-add-on-for-microsoft-security-is-now-available/ba-p/3171272)

Ciao.

Giuseppe

Re: the best way to collect Windows Defender logs?

corti77 — Sat, 02 Sep 2023 09:50:36 GMT

Hi @gcusello ,

are you sure that app includes the basic Microsoft Defender included in any Microsoft OS?

checking the app documentation mentions Microsoft 365 Defender and Defender for Endpoint products. Those are the EDR and SOAR solutions from Microsoft , no mention of the basic AV logs.

https://docs.splunk.com/Documentation/AddOns/released/MSSecurity/Releasehistory

thanks

Re: the best way to collect Windows Defender logs?

gcusello — Sat, 02 Sep 2023 10:04:42 GMT

Hi @corti77,

you're right, this Add-on is for the O365 Defender,

but for my little knowledge of Defender (I'm not a fan of it!) and it's possible I'm wrong, it should be possible to have Defender logs from Cloud, using this Add-On.

If it isn't possible, sorry for my wrong answer!

Ciao.

Giuseppe

Re: the best way to collect Windows Defender logs?

RichieOl — Fri, 20 Oct 2023 08:55:41 GMT

Hi,

I am having this same issue at the moment as the domain i manage is completely airgapped form the internet so no cloud connectivity. After some digging i found have read there are events in the event viewer.

Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

1116 - MALWAREPROTECTION_STATE_MALWARE_DETECTED

1117 - MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN

1118 - MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED

1119 - MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED

I haven't tested them yet as i have literally just found them online this minute and came across this message board at the same time.

I hope this helps and if you have found anything extra can you put them in here too. Im going set up the forwarder now to collect these and create a dashboard

Richard

Re: the best way to collect Windows Defender logs?

jcarlosgraca — Fri, 16 Feb 2024 13:05:38 GMT

Hello,

you can collect the logs with the following configuration on inputs.conf:

[WinEventLog://Microsoft-Windows-Windows Defender/Operational] disabled = 0 index = windefender evt_resolve_ad_obj = 1