I have running Windows Defender and want to collect logs to Splunk.
Logs not collected.
What should I do to fix it? I have no idea.
Did you deploy the add-on to the Windows host you wish to get the logs from?
Ideally, you would do this from the Forwarder Manager (Settings->Forwarder Management).
Copy the add-on from $SPLUNK/etc/apps to $SPLUNK/etc/deploy-apps.
Create a new folder "local" in $SPLUNK/etc/deploy-apps//
Copy the inputs.conf from the "default" folder to "local" (the one you just created)
Change "disabled = true" to "disabled = false"
Verify that the TA_microsoft-windefender folder is on the host you wish to get that data from and then you should be good to go.
Restart the forwarder service (services.msc) for good measure.
I did it all and it's not helped.
Bring up the Event Viewer on the Windows box you're trying to get those logs from and verify that it is indeed logging the events under "Applications and Services Logs"
So, if i generating new event (downloaded poor virus that windefender detect) it's sends logs. One problem is resolved \o/
But another problem, how to collect all logs from Windefender?
Not only new. All from beginning to now. And yes in Event Viewer in
Microsoft-Windows-Windows Defender/Operational there are many logs.
[WinEventLog://Microsoft-Windows-Windows Defender/Operational] index = windefender disabled = false start_from = oldest current_only = 0 renderXml = 1
This works for me:
index = windefender
disabled = false
renderXml = 1
I confirm logs coming into Splunk for index=windefender with that input. Confirm that your Windows Defender log location is correct for your system.
In my previous comment I said that logs coming, but only new. I need historical (old) and new logs.
It looks like the start_from and current_only stanzas dont appear anymore in the inputs.conf definition. Maybe it is no longer supported?
Maybe, but how me collect all logs of windefender that i have on my PC? 🙂