All Apps and Add-ons
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

TA MS Defender not working

titoluna07
Explorer
‎10-05-2020 11:13 AM

I have this add-on "TA Microsoft Windows Defender" installed in our UFs using a deployment server. All configuration is the same in all UFs, but some are working (sending logs to Splunk Cloud), and the others are not.
I can see all servers are successfully sending other event log events, systems, applications, and security, but some do not send windows defender logs. Core functionality is working with no errors related to the defender TA as well.
I have this on windows server 2016.

Thanks!

Labels (3)
0 Karma
Reply
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...