Creating Data Collection rule for Windows Defender AV event

Question

Hello,
I'm using AMA and I would want to collect Windows Defender AV events to Log Analytics but I'm not sure how to do it in Data collection rule.

Those Defender evets are located in following path: Microsoft-Windows-Windows Defender/Operational which means that I should probably do custom rule by using XPath queries because they are not in basic tab.

Here is example path of the events but how do I insert Select Path="Microsoft-Windows-Windows Defender/Operational" in my DCR? Just doing System!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]] won't get those events,

<QueryList>  
  <Query Id="0" Path="Microsoft-Windows-Windows Defender/Operational">  
    <Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[(Level=1  or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]</Select>  
  </Query>  
</QueryList>  

Answer 1

Hi @Bombbe ,

As you are trying to get the event logs from Microsoft-Windows-Windows Defender/Operational in AMA, please use the XPath query as shown below (note that the double-quotes are not present with the log path)

Microsoft-Windows-Windows Defender/Operational!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]

In Portal, it would look like:

I verified a few minutes back that the events do get collected in LogAnalytics workspace using this Xpath:

Please let me know if you have any questions.

---
Please 'Accept as answer' if it helped so that it can help others in the community looking for help on similar topics.

Answer 2

I would try "Microsoft-Windows-Windows Defender/Operational"!*

or

"Microsoft-Windows-Windows Defender/Operational"!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]