How can I view scan logs from Windows Defender?

[5plunked]

Hi,

I have installed the SplunkUniversalForwarder and ave sucessfully got data into Splunk. However, i want to view the scan logs from Windows Defender, how should i search it on the search head?

Thanks in advance!

[pdoconnell]

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there.

[lfedak_splunk]

Would your TA work for this, @pdoconnell?

[pdoconnell]

Yup, this looks like me. I'm currently getting my TA certified, but if you want to look into it @5splunked, you can at https://github.com/pdoconnell/TA-microsoft-windefender