Splunk Search

Windows Defender discovery on Splunk?

SecurityBear
Engager

Hi everybody.

I'm back using Splunk after some years, so I'm a bit "rusty".

This is my scenario: suppose I have a network with some hosts, both workstation and servers. I know only that an antivirus is installed on them, but not which one for all of the hosts. What I know is:

1. Some hosts has Windows Defender, other not.
2. The Windows Defender Logs are configured to be sent to splunk.

The other data mising is: the hosts with Defender, how are configured to get data? With a Splunk app? This is a data I have not.

So, my question is: is there a Splunk query that I can use to discover if Defender is in execution or not. formatting the result to show the hostname of every machine?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SecurityBear,

are you abke to identify Windows Defender's logs?

if yes (e.g. they are in a special Index, e.g. windefender), you can easily list all the hostnames in that index:

index=windefender
| stats count BY host

If instead your problem is to identify Defender's logs, you could see if you're using the Add-on for Defender (https://splunkbase.splunk.com/app/3734/).

In this TA you can identify Defender's Logs.

if instead you don't use the above TA, you should see in your inputs.conf where these logs are stored and which is the sourcetype and the source.

Ciao.

Giuseppe

View solution in original post

0 Karma

SecurityBear
Engager

I understand: many thanks Giuseppe.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SecurityBear,

good for you, see next time!

If this answer solves your need, please, accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @SecurityBear,

are you abke to identify Windows Defender's logs?

if yes (e.g. they are in a special Index, e.g. windefender), you can easily list all the hostnames in that index:

index=windefender
| stats count BY host

If instead your problem is to identify Defender's logs, you could see if you're using the Add-on for Defender (https://splunkbase.splunk.com/app/3734/).

In this TA you can identify Defender's Logs.

if instead you don't use the above TA, you should see in your inputs.conf where these logs are stored and which is the sourcetype and the source.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...