Monitoring Splunk

Windows Defender logs

seanmartin
Observer

Hi, I know as part of SPL-212687 this issue was fixed in 8.2.7 and 9.0+ however we have had some hosts drop their defender logs after receiving a Windows Defender update. These UFs are on version 9.0.2 but have still reported this issue.

Is there any known problem that would cause this?

Labels (1)
0 Karma

seanmartin
Observer

We have had a second instance of this happening overnight.

Last nights update is 4.18.24020.7

The previous update that caused this issue was 4.18.23110.3

 

Both are showing up in event viewer as event ID: 2014

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...