topic Re: how to add Microsoft-Windows-Windows Defender in Log Storage? in Alerting

Adding Microsoft-Windows-Windows Defender in Log Storage

McVitas — Thu, 06 Jul 2023 14:24:07 GMT

Hello, I want to create alert based on certain events from this eventlog, but can't figure out how to make Dynatrace ingest it.

We have one Log storage configuration rule like this

and this works and default eventlogs are visible in Log viewer. I tried adding this Microsoft-Windows-Windows Defender/Operational

like this:

but nothing comes up. According to this documentation page I tried adding a full path to the evtx file which is %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx but this also don't seem to work.

I tried to add the same in Custom log source configuration like this

but still no events show up even though there are new events happening for example when I disable/enable realtime protection in Windows Security GUI.

Ideas?

Re: how to add Microsoft-Windows-Windows Defender in Log Storage?

McVitas — Thu, 29 Jun 2023 09:25:06 GMT

Thanks to my colleague @Ranjeet_Tiwari it now works. The log storage matcher is changed to

and custom log source rule is like this

However I am not very wise from this and it still doesn't make much sense to me :-]

Re: how to add Microsoft-Windows-Windows Defender in Log Storage?

AgataWlodarczyk — Thu, 06 Jul 2023 14:25:28 GMT

Thanks for sharing the answer, @McVitas 🙂