How can I view scan logs from Windows Defender?

5plunked · ‎10-08-2017

Hi,

I have installed the SplunkUniversalForwarder and ave sucessfully got data into Splunk. However, i want to view the scan logs from Windows Defender, how should i search it on the search head?

Thanks in advance!

pdoconnell · ‎10-09-2017

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there.

lfedak_splunk · ‎10-09-2017

Would your TA work for this, @pdoconnell?

pdoconnell · ‎10-09-2017

Yup, this looks like me. I'm currently getting my TA certified, but if you want to look into it @5splunked, you can at https://github.com/pdoconnell/TA-microsoft-windefender

How can I view scan logs from Windows Defender?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation

How can I view scan logs from Windows Defender?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform