Logs not coming from Windows Defender

[test_qweqwe]

Hi
I have running Windows Defender and want to collect logs to Splunk.

1. Windows Defender that running on my host Windows 10 Enterprise LTSB;
2. Splunk 7.0 that collect logs local from my host;
3. TA for Microsoft Windows Dedender;

Logs not collected.
What should I do to fix it? I have no idea.

[mjeffery_splunk]

Did you deploy the add-on to the Windows host you wish to get the logs from?

Ideally, you would do this from the Forwarder Manager (Settings->Forwarder Management).
Copy the add-on from $SPLUNK/etc/apps to $SPLUNK/etc/deploy-apps.
Create a new folder "local" in $SPLUNK/etc/deploy-apps//
Copy the inputs.conf from the "default" folder to "local" (the one you just created)
Change "disabled = true" to "disabled = false"

Verify that the TA_microsoft-windefender folder is on the host you wish to get that data from and then you should be good to go.

Restart the forwarder service (services.msc) for good measure.

[test_qweqwe]

I did it all and it's not helped.

[mjeffery_splunk]

Bring up the Event Viewer on the Windows box you're trying to get those logs from and verify that it is indeed logging the events under "Applications and Services Logs"

[test_qweqwe]

So, if i generating new event (downloaded poor virus that windefender detect) it's sends logs. One problem is resolved \o/

But another problem, how to collect all logs from Windefender?
Not only new. All from beginning to now. And yes in Event Viewer in Microsoft-Windows-Windows Defender/Operational there are many logs.

[test_qweqwe]

My config

[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
index = windefender
disabled = false
start_from = oldest
current_only = 0
renderXml = 1

[pdoconnell]

This works for me:
[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
index = windefender
disabled = false
renderXml = 1

I confirm logs coming into Splunk for index=windefender with that input. Confirm that your Windows Defender log location is correct for your system.

[test_qweqwe]

Hi!
In my previous comment I said that logs coming, but only new. I need historical (old) and new logs.

[pdoconnell]

It looks like the start_from and current_only stanzas dont appear anymore in the inputs.conf definition. Maybe it is no longer supported?

[test_qweqwe]

Maybe, but how me collect all logs of windefender that i have on my PC? 🙂