Microsoft Defender AntiVirus - Technical Add-on
Overview
Details
This add-on is intended as a complement to the Splunk Add-on for Microsoft Windows, which also manages the basic operations of the field extraction from the xml or raw events. If you have installed that add-on you can also use this one to extract more information and present it according to CIM.
Code is hosted on Github: https://github.com/nextpart/Defender_TA_nxtp
Technical Add-On for Windows Defender
This extension for Splunk® is a rewrite of the Add-on already created by pdoconnell (TA-microsoft-windefender) that we adapt to our needs and requirements.
At this point we would like to thank Patrick for the great work he has done with his project and from which we could learn a lot as well as all the other members of the Splunk Community who publish their work. You are heroes :clap:
Code is hosted on Github: https://github.com/nextpart/Defender_TA_nxtp
Author information
- Author: Nextpart Security Intelligence GmbH
- Version:
X.X.X(dynamic) - Creation: July, 2022
Using this Application
Source: XmlWinEventLog
Sourcetype: WinEventLog:Microsoft-Windows-Windows Defender/Operational
This add-on is intended as a complement to the Splunk Add-on for Microsoft Windows, which also manages the basic operations of the field extraction from the xml or raw events. If you have installed that add-on you can also use this one to extract more information and present it according to CIM.
Upgrade
Remove the app using splunk plugin tool
$SPLUNK_HOME/bin/splunk remove app Defender_TA_nxtp
Install the app
$SPLUNK_HOME/bin/splunk install app Defender_TA_nxtp_<version>.tgz
Forwarding Data
Once you have installed the Technical Add-On you can start sending data. In order to do so you need Windows instances running Windows Defender AntiVirus and the Splunk Universal Forwarder with the according configuration for you environment. Then you can also use this add-on on your endpoints and activate forwarding by adding the following content to the inputs.conf file in the local directory:
# Custom Inputs.conf for microsoft windows defender events
[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
disabled = false
blacklist = 1001, 1150, 2011, 2000, 2001, 2002, 2010