How to query for basic malware outbreak?

[Deeksha]

I need a query for basic malware outbreak

Deeksha_0-1671675972843.png

Need query with server IP and server name from this raw logs.

[yottanat2021]

you have to install ta-windows for extract fields and use field to query

search example:
index=* source="WinEventLog:Security" | table _time src src_ip dest action app signature

[Deeksha]

Thanks for your reply, but we are using Trend Micro Apex One as an antivirus and we are able to extracting from the same.

Could you please confirm that TA for Microsoft Windows Defender will support Trend Micro Apex One?