How can I view scan logs from Windows Defender?

5plunked · ‎10-08-2017

Hi,

I have installed the SplunkUniversalForwarder and ave sucessfully got data into Splunk. However, i want to view the scan logs from Windows Defender, how should i search it on the search head?

Thanks in advance!

pdoconnell · ‎10-09-2017

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there.

lfedak_splunk · ‎10-09-2017

Would your TA work for this, @pdoconnell?

pdoconnell · ‎10-09-2017

Yup, this looks like me. I'm currently getting my TA certified, but if you want to look into it @5splunked, you can at https://github.com/pdoconnell/TA-microsoft-windefender

How can I view scan logs from Windows Defender?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

How can I view scan logs from Windows Defender?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs