CMK version: RAW 2.4.0p13 OS version: Debian 12 Hi, is there a (simple) way to monitor the defender logfile on windows hosts? I found many different solutions, but none of them are working for us. Thanks in advance!

How it`s say in “Indiana Jones and the Last Crusade” the Grail Knight says to him: “Choose wisely.” Option 1 — Windows Eventlog via agent config (no Agent Bakery in CRE) Since you’re on RAW, there’s no Agent Bakery. You need to manually configure the Windows agent on each host. Edit or create C…

[image] madman: I found many different solutions what solution you have tested and what you aspect? KR Bernd Hi @madman , There are a few approaches to monitor Windows Defender logs with Checkmk RAW. Here’s what works: Option 1 — Windows Eventlog monitoring (built-in, recommended) Option …

Hi, thanks! What would I have to do for option 1? Maybe I did something wrong? I couldn’t find the rule (Enterprise only?) and online tutorials explain log forwarding to the EC. :confused:

[image] Monitor Windows event logs and custom log files with Checkmk Robin shows how to monitor Windows event logs and custom log files. The agent collects event logs, and custom log files are monitored using rules. Agent plugin or EC [image] The E…

Hej, thank you very much. :slight_smile: Thanks to you I could finally figure out how to get Option 1 working. In the end, this yaml config did the trick: global: # section may be fully disabled enabled: yes logwatch: enabled: yes sendall: no vista_api: yes logfile: -…

Hej, may I ask follow up questions? :slight_smile: Is it possible that all the default logs will not forward events anymore, as soon as I enable logwatch in the .yaml? Would that imply that I have to add every log to my yaml-configuration, if I want it monitored? Also, I just realized, that some c…

Checkmk Forum

Monitoring Windows Defender Log

General

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled

Update cookie preferences