Getting Data In

How can I view scan logs from Windows Defender?

Explorer

Hi,

I have installed the SplunkUniversalForwarder and ave sucessfully got data into Splunk. However, i want to view the scan logs from Windows Defender, how should i search it on the search head?

Thanks in advance!

0 Karma

Path Finder

Said this above, but look at https://github.com/pdoconnell/TA-microsoft-windefender for now. When this ends up on SplunkBase, I'll link there.

Splunk Employee
Splunk Employee

Would your TA work for this, @pdoconnell?

0 Karma

Path Finder

Yup, this looks like me. I'm currently getting my TA certified, but if you want to look into it @5splunked, you can at https://github.com/pdoconnell/TA-microsoft-windefender

0 Karma