Send Windows Defender Events to Wazuh

Sending Windows Defender events to Wazuh lets you review antivirus detections and related activity alongside other endpoint alerts. The usual setup is to enable the relevant Windows event channel, configure the Wazuh agent to collect it, then verify that events reach the manager and appear in the dashboard.

What You’ll Need

• A Windows computer with Microsoft Defender Antivirus and a Wazuh agent installed and enrolled with a Wazuh manager.
• Administrator access to configure Windows and edit the agent configuration.
• Access to the Wazuh manager and dashboard, plus permission to restart the agent and inspect alerts.

Step-by-Step

1. Check that the agent is connected. In the Wazuh dashboard, open the agents view and confirm the Windows endpoint is active. If it is disconnected, resolve that first; event collection cannot reach the manager while the agent is offline.
2. Identify the Defender event channel. On the Windows endpoint, open Event Viewer. Expand Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational. The channel’s event log name is generally Microsoft-Windows-Windows Defender/Operational. Confirm that the log exists and contains recent events. Names can vary on older Windows releases, so use the channel shown by Event Viewer on your machine.
3. Enable the log if it is disabled. In Event Viewer, right-click the Operational log and select Enable Log if that option is available. You can also inspect or enable it in an elevated PowerShell session:
   wevtutil gl "Microsoft-Windows-Windows Defender/Operational"
   If needed, enable it with:
   wevtutil sl "Microsoft-Windows-Windows Defender/Operational" /e:true
   Run these commands as an administrator. Do not clear the log as part of setup.
4. Back up the agent configuration. On the Windows computer, locate the Wazuh agent installation directory and make a copy of ossec.conf before editing it. The default installation path is commonly under C:\Program Files (x86)\ossec-agent, but use the path chosen during installation if different.
5. Add Windows event-channel collection. Open the agent’s ossec.conf in an editor with administrator privileges. Inside the existing <ossec_config> element, add this block, taking care not to place it inside another configuration section:
   <localfile>
  <location>Microsoft-Windows-Windows Defender/Operational</location>
  <log_format>eventchannel</log_format>
</localfile>
   Use the channel name confirmed in Event Viewer. If the file already has a matching localfile entry, check it rather than adding a duplicate.
6. Save and validate the configuration. Save the file as plain text, retaining the filename ossec.conf. Check that the XML tags are balanced and that the new block is within ossec_config. If the agent fails to start after the edit, restore the backup or correct the XML before proceeding.
7. Restart the Wazuh agent. Open the Windows Services console, find the Wazuh agent service, and choose Restart. Alternatively, use an elevated PowerShell window and the service name shown on your system. Check that the service returns to a running state.
8. Generate or locate a test event. First check existing events in the Defender Operational log; do not trigger malware or disable protection to create a test. If there are no relevant events, wait for normal Defender activity or use a safe, organization-approved test procedure. Note the event time and event ID for comparison.
9. Confirm receipt in Wazuh. Search the dashboard’s Security events for the Windows agent and the test time. Filter on the Defender channel or event provider where available. You can also inspect the manager’s alert data if your deployment stores alerts there. Collection sends event records; whether a particular record becomes a security alert depends on Wazuh rules and alert settings.

Common Mistakes

• Using a channel name copied from another Windows version instead of checking the local Event Viewer.
• Putting the localfile block outside ossec_config, misspelling a tag, or adding duplicate channel entries.
• Editing the manager configuration instead of the Windows agent’s ossec.conf.
• Assuming collection failed because no high-severity alert appeared. Events may be collected without matching a rule that generates an alert.
• Testing with an event that predates the agent configuration change. Newly configured collection should be checked against events recorded afterward.

Tips

• Start with the Defender Operational channel. Add other Windows channels only when there is a specific monitoring need, because broad collection increases event volume.
• Record the agent name, channel, event ID, and timestamp when testing. This makes it easier to distinguish a collection issue from a search or rule issue.
• Keep a copy of the original configuration and make one change at a time. This simplifies recovery and troubleshooting.
• Plan retention and alerting separately. Wazuh event collection, alert creation, and storage or indexing are related but distinct parts of the pipeline.

Troubleshooting

No events arrive: Confirm the log is enabled and has recent records in Event Viewer. Verify the exact channel spelling in ossec.conf, restart the agent, and confirm the endpoint is active in Wazuh. Check the agent logs under its installation directory for XML parsing errors, inaccessible channels, or connection problems.

The agent will not restart: Restore the backup configuration or inspect the edited file for unmatched tags, duplicate malformed sections, or text accidentally inserted outside ossec_config. Restart after correcting the file and check the service status again.

The agent is active, but the dashboard is empty: Search a wider time range and confirm the selected agent. Check whether the event exists locally after collection was configured. Then inspect manager-side logs and event data to determine whether the agent forwarded it. Confirm dashboard filters and index availability before changing detection rules.

Events arrive but no alert is generated: This may be expected. A collected Windows event is not automatically an alert. Check the event data and the applicable Wazuh rules, and only adjust detection or alert configuration when the monitoring requirement is clear. Follow your deployment’s configuration and change-control process.

Frequently Asked Questions

Which Defender events does this collect?
It collects records from the configured Windows Defender Operational channel. The records available depend on Windows, Defender activity, and the channel’s logging settings.

Do I need to configure the Wazuh manager?
For basic collection from a Windows agent, the channel is configured in the agent’s ossec.conf. Additional manager rules may be needed if you want specific events to create alerts.

Will historical Defender events be sent after setup?
Do not assume the agent will forward the entire existing log. Verify collection with events recorded after setup and check your Wazuh version’s event-channel behavior if backfill is required.

Can I collect other Windows event logs the same way?
Yes. Add a separate localfile entry for each required channel, using its exact Event Viewer name and eventchannel format. Keep collection focused to control volume.

Why do I see the event in Windows but not as a Wazuh alert?
The agent may not be collecting or forwarding it, or the event may not match an alerting rule. Check the local log, agent logs, manager receipt, dashboard filters, and rules in that order.

Related

• ChatGPT Network Error on Long Replies: Fixes
• Couldn’t Unmount Disk on Mac: How to Fix the Error
• How to Move and Organize Apps on Apple TV