Windows Defender Log File

Comments

2 comments

  • Avatar
    Harinder Bhandari

    Yes, it is possible to create an alert for Windows Defender Logs based on a certain Event ID. For example, Event ID 5001

    _sourceCategory="windows/events/windows_defender"
    | parse "EventCode = *;" as EventCode
    | where EventCode matches "5001"
    | count by EventCode
    | where EventCode > "0"

    Now you can set up an alert where an alert condition is the number of results > 0. 

    https://help.sumologic.com/Visualizations-and-Alerts/Alerts/03-Create-a-Real-Time-Alert

    0
    Comment actions Permalink
  • Avatar
    CJ Vallade

    Thank you for the reply and I apologize for not getting back to you sooner.  I was trying to create the new alert, but I'm not sure I am adding it in the right spot.  Can I just create a new alert with the options above?  I tried to do that but it was giving me an error about a timeshift value?  

    0
    Comment actions Permalink

Please sign in to leave a comment.