All Apps and Add-ons

Logs not coming from Windows Defender

test_qweqwe
Builder

Hi
I have running Windows Defender and want to collect logs to Splunk.

  1. Windows Defender that running on my host Windows 10 Enterprise LTSB;
  2. Splunk 7.0 that collect logs local from my host;
  3. TA for Microsoft Windows Dedender;

Logs not collected.
What should I do to fix it? I have no idea.

0 Karma

mjeffery_splunk
Splunk Employee
Splunk Employee

Did you deploy the add-on to the Windows host you wish to get the logs from?

Ideally, you would do this from the Forwarder Manager (Settings->Forwarder Management).
Copy the add-on from $SPLUNK/etc/apps to $SPLUNK/etc/deploy-apps.
Create a new folder "local" in $SPLUNK/etc/deploy-apps//
Copy the inputs.conf from the "default" folder to "local" (the one you just created)
Change "disabled = true" to "disabled = false"

Verify that the TA_microsoft-windefender folder is on the host you wish to get that data from and then you should be good to go.

Restart the forwarder service (services.msc) for good measure.

0 Karma

test_qweqwe
Builder

I did it all and it's not helped.

0 Karma

mjeffery_splunk
Splunk Employee
Splunk Employee

Bring up the Event Viewer on the Windows box you're trying to get those logs from and verify that it is indeed logging the events under "Applications and Services Logs"

0 Karma

test_qweqwe
Builder

So, if i generating new event (downloaded poor virus that windefender detect) it's sends logs. One problem is resolved \o/

But another problem, how to collect all logs from Windefender?
Not only new. All from beginning to now. And yes in Event Viewer in Microsoft-Windows-Windows Defender/Operational there are many logs.

0 Karma

test_qweqwe
Builder

My config

[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
index = windefender
disabled = false
start_from = oldest
current_only = 0
renderXml = 1
0 Karma

pdoconnell
Path Finder

This works for me:
[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
index = windefender
disabled = false
renderXml = 1

I confirm logs coming into Splunk for index=windefender with that input. Confirm that your Windows Defender log location is correct for your system.

0 Karma

test_qweqwe
Builder

Hi!
In my previous comment I said that logs coming, but only new. I need historical (old) and new logs.

0 Karma

pdoconnell
Path Finder

It looks like the start_from and current_only stanzas dont appear anymore in the inputs.conf definition. Maybe it is no longer supported?

0 Karma

test_qweqwe
Builder

Maybe, but how me collect all logs of windefender that i have on my PC? 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...