# Adding Microsoft-Windows-Windows Defender in Log Storage

**URL:** <https://community.dynatrace.com/t/adding-microsoft-windows-windows-defender-in-log-storage/40428>\
**Category:** Alerting\
**Tags:** windows, log-configuration, problems-classic, logs\
**Created:** [June 28, 2023, 9:33am UTC](https://community.dynatrace.com/t/adding-microsoft-windows-windows-defender-in-log-storage/40428 "2023-06-28T09:33:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![McVitas](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@McVitas](https://community.dynatrace.com/u/McVitas)\
**Post date:** [June 28, 2023, 9:33am UTC](https://community.dynatrace.com/t/adding-microsoft-windows-windows-defender-in-log-storage/40428/1 "2023-06-28T09:33:58Z")

</div>

Hello, I want to create alert based on certain events from this eventlog, but can’t figure out how to make Dynatrace ingest it.

We have one Log storage configuration rule like this

![McVitas_0-1687944295051.png](https://global.discourse-cdn.com/dynatrace/original/2X/4/47bf89da251cd24ba35876f9d929d45847c669e8.png)

and this works and default eventlogs are visible in Log viewer. I tried adding this Microsoft-Windows-Windows Defender/Operational

![McVitas_1-1687944334824.png](https://global.discourse-cdn.com/dynatrace/original/3X/f/1/f1e873ab65fe9d9578134f87b94bbcfdef2b0ae9.png)

like this:

 ![McVitas_2-1687944384404.png](https://global.discourse-cdn.com/dynatrace/original/3X/e/e/eea3538b47edc18c68188a8635c8b3eef5982a45.png)

but nothing comes up. According to [this documentation page](https://www.dynatrace.com/support/help/observe-and-explore/logs/log-monitoring/acquire-log-data/add-log-files-manually-v2#expand--example) I tried adding a full path to the evtx file which is %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx but this also don’t seem to work.

I tried to add the same in Custom log source configuration like this

 ![McVitas_3-1687944747199.png](https://global.discourse-cdn.com/dynatrace/original/2X/0/00d2bb71c4d4ff67e5910d85860ca2c2bd26b380.png)

but still no events show up even though there are new events happening for example when I disable/enable realtime protection in Windows Security GUI.

Ideas?

---

<div class="post-metadata">

**Author:** ![McVitas](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@McVitas](https://community.dynatrace.com/u/McVitas)\
**Post date:** [June 29, 2023, 9:25am UTC](https://community.dynatrace.com/t/adding-microsoft-windows-windows-defender-in-log-storage/40428/2 "2023-06-29T09:25:06Z")

</div>

Thanks to my colleague&nbsp;[@Ranjeet\_Tiwari](https://community.dynatrace.com/user/63586)&nbsp;it now works. The log storage matcher is changed to

![McVitas_0-1688030602758.png](https://global.discourse-cdn.com/dynatrace/original/3X/e/d/edb3adef7e957ad02701e0776b582a0013c3cc4b.png)

and custom log source rule is like this

 ![McVitas_1-1688030665347.png](https://global.discourse-cdn.com/dynatrace/original/3X/5/5/55ed58a22cb54e7596b737c7495dca9872dd002e.png)

However I am not very wise from this and it still doesn’t make much sense to me :-]

---

<div class="post-metadata">

**Author:** ![agata.wlodarczyk](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/agata.wlodarczyk/32/22_2.png) [@agata.wlodarczyk](https://community.dynatrace.com/u/agata.wlodarczyk)\
**Post date:** [July 6, 2023, 2:25pm UTC](https://community.dynatrace.com/t/adding-microsoft-windows-windows-defender-in-log-storage/40428/3 "2023-07-06T14:25:28Z")

</div>

Thanks for sharing the answer,&nbsp;[@McVitas](https://community.dynatrace.com/user/63414)&nbsp;🙂