Windows Defender Log File



  • Avatar
    Harinder Bhandari

    Yes, it is possible to create an alert for Windows Defender Logs based on a certain Event ID. For example, Event ID 5001

    | parse "EventCode = *;" as EventCode
    | where EventCode matches "5001"
    | count by EventCode
    | where EventCode > "0"

    Now you can set up an alert where an alert condition is the number of results > 0.

    Comment actions Permalink
  • Avatar
    CJ Vallade

    Thank you for the reply and I apologize for not getting back to you sooner.  I was trying to create the new alert, but I'm not sure I am adding it in the right spot.  Can I just create a new alert with the options above?  I tried to do that but it was giving me an error about a timeshift value?  

    Comment actions Permalink

Please sign in to leave a comment.