Getting Data In

How to monitor Windows Defender evtx file?

DD
Loves-to-Learn Lots

Hello everyone,

I try to "ADD DATA" and specifically add the file "Microsoft-Windows-Windows Defender% 4Operational.evtx", but always Splunk fails to parse it and displays unreadable data.

My goal is to monitor my Windows Defender logs, so I tried to set the source type to "preprocess-winevt" as suggested in one article, but the result of this was quite strange, and the data, as you can see in the image, was neat but on the other hand, the data was not being parsed eventually.

fail_parsering_question.PNG

 

 

 

 

 

 

 

 

Also, I do not understand why Splunk manages to parse ".evtx" files such as "application, security and more..." but on the other hand, can not parse the ".evtx" file from the same directory and machine?

-- What am I doing wrong?

I mention that I want to get the file data of: "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Defender% 4Operational.evtx"

 

Labels (6)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!