...
Microsoft Windows Defender Antivirus is a built-in antimalware solution that provides protection for desktops, portable computers, and servers. It operates as an Endpoint Protection Platform (EPP) alongside Windows Firewall, Device Guard, and other security technologies in Windows 10. Windows Defender Antivirus makes extensive use of Microsoft's cloud-based detection, advanced real-time heuristics, and integrated reputation-based identification of files, URLs, and emails.
Device Information
Entity | Particulars |
---|---|
Vendor Name | Microsoft |
Product Name | Windows Defender Antivirus |
Type of Device | Hosted |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol | Log Collection Method |
---|---|---|---|
Windows Defender AV | WINDOWS_DEFENDER_AV | NXLog = JSON over Syslog | CyberHub |
Port Requirements
Source | Destination | Port |
---|---|---|
Windows Defender AV | CyberHub | 6514 (TCP) |
Device Configuration
Pre-requisite
...
Download and install the NXLog agent from the following location: https://nxlog.co/products/nxlog-community-edition/download.
Navigate to
services.msc
and stop the nxlog service.Go to the folder
"C:\Program Files\nxlog\data"
and delete the file"configcache.dat"
if it present.Navigate to the installed location
"C:\Program Files\nxlog\conf."
Rename the attached
file toView file name NXLog.conf "nxlog.conf"
and copy it into this folder.Replace the placeholder
"CyberHub IP"
with the actual CyberHub IP in the nxlog.conf file.Copy the previously created certificate file on Windows machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile" on line number 56.
Now, start the nxlog service from services.msc.
NXLog agent logs will be available at the location
"C:\Program Files\nxlog\data\nxlog.log"
.The log flow should work, and you can check it using tcpdump with the command
"tcpdump -AA port 6514"
...
Parameters required from customer for Integration.
Property | Default Value | Description |
---|---|---|
IP Address | Windows Defender AV interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub. |