Splunk Windows Universal Forwarder stops forwarding Windows Defender logs after Platform Update

Applicability

Description

Windows Defender logs stop being forwarded but other Winevent logs continue to forward until Universal Forwarder is restarted.

Impacted Versions
Splunk Universal Forwarder version(s) 9.0.1, 9.0.4
Windows OS: OS Name Microsoft Windows Server 2019 Standard

Input details:
etc/apps/{app_name}/local/inputs.conf
[WinEventLog://Microsoft-Windows-Windows Defender/Operational]
blacklist1 = EventCode="(1000|1001|1003|1004|1122|1128|1134|1150|2010|2011)"
checkpointInterval = 5
current_only = 0
disabled = 0
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = xxxxxxx
ndex = winserver_log
interval = 60
start_from = oldest

Investigation

1. Download the latest Windows Defender platform engine from Microsoft site and run the executable with administrative privilege
2. Check the platform engine version changed to the latest version. This is to make sure that the update has been completed.
3. test by injecting a eicar file (this can download eicar file from eicar.org or eicar.com)
4. Verify event log are forwarded by Splunk Universal Forwarder
5. Check the Splunk query result
   index={index} sourcetype="Microsoft-Windows-Windows_Defender/Operational" {host} | table EventCode _time

this will show no results
6. Restart Splunk UF service
7. Check the Splunk query result and results will appear

Resolution

• Issue is due to known caveat existing on Windows Universal Forwarder version 9.0.4
• Upgrade to 9.1.0 and issue is resolved