How can I view scan logs from Windows Defender?

5plunked · ‎10-08-2017

Hi,

I have installed the SplunkUniversalForwarder and ave sucessfully got data into Splunk. However, i want to view the scan logs from Windows Defender, how should i search it on the search head?

Thanks in advance!

pdoconnell · ‎10-09-2017

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there.

lfedak_splunk · ‎10-09-2017

Would your TA work for this, @pdoconnell?

pdoconnell · ‎10-09-2017

Yup, this looks like me. I'm currently getting my TA certified, but if you want to look into it @5splunked, you can at https://github.com/pdoconnell/TA-microsoft-windefender

How can I view scan logs from Windows Defender?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

How can I view scan logs from Windows Defender?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...