Windows defender

[Soc Support]

How to collect Windows defender logs in Wazuh?

[hasitha.u...@wazuh.com]

Hi Soc Support

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[hasitha.u...@wazuh.com]

Windows Defender logs can be collected directly through the Wazuh agent by reading the Defender event channel.

You can add the following configuration to the Windows agent's ossec.conf file:

1. <localfile>
2.  <location>Microsoft-Windows-Windows Defender/Operational</location>
3.  <log_format>eventchannel</log_format>
4. </localfile>

The eventchannel format tells the Wazuh agent to read logs directly from the Windows Event Log, and Microsoft-Windows-Windows Defender/Operational is the channel where Windows Defender writes its events.

You can add this directly to the agent's ossec.conf at:

C:\Program Files (x86)\ossec-agent\ossec.conf

Or, if you want to apply the configuration to multiple Windows agents, you can push it through centralized configuration using agent.conf.

Once the configuration is added, restart the Wazuh agent. You can do this from an elevated PowerShell using:

Restart-Service WazuhSvc

There’s no need to create rules for this. We already include a Windows Defender ruleset, so once the agent starts sending the events, they should be processed automatically by the manager.
Ref: https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/win-defender-logs-collection.html

However, if you need to create custom rules, you can check this document for more details.
Ref: https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html

Let me know if you need further assistance with this. Thanks!

[Soc Support]

Hello Hasitha,

It works for me. Thank you so much for your help, really appreciate it!