Windows Defender discovery on Splunk?

[SecurityBear]

Hi everybody.

I'm back using Splunk after some years, so I'm a bit "rusty".

This is my scenario: suppose I have a network with some hosts, both workstation and servers. I know only that an antivirus is installed on them, but not which one for all of the hosts. What I know is:

1. Some hosts has Windows Defender, other not.
2. The Windows Defender Logs are configured to be sent to splunk.

The other data mising is: the hosts with Defender, how are configured to get data? With a Splunk app? This is a data I have not.

So, my question is: is there a Splunk query that I can use to discover if Defender is in execution or not. formatting the result to show the hostname of every machine?

[SecurityBear]

I understand: many thanks Giuseppe.

[gcusello]

Hi @SecurityBear,

good for you, see next time!

If this answer solves your need, please, accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @SecurityBear,

are you abke to identify Windows Defender's logs?

if yes (e.g. they are in a special Index, e.g. windefender), you can easily list all the hostnames in that index:

index=windefender
| stats count BY host

If instead your problem is to identify Defender's logs, you could see if you're using the Add-on for Defender (https://splunkbase.splunk.com/app/3734/).

In this TA you can identify Defender's Logs.

if instead you don't use the above TA, you should see in your inputs.conf where these logs are stored and which is the sourcetype and the source.

Ciao.

Giuseppe