Free tools Windows power users keep installed
One-click scans. No signup required.
To collect Windows Defender Antivirus events in Wazuh, configure the Windows agent to monitor the Microsoft-Windows-Windows Defender/Operational event channel using the eventchannel format. Wazuh includes Defender decoders and baseline rules, so you can start without writing a custom decoder. You still need to add the channel to the agent configuration, then confirm that events reach the manager.
What Wazuh collects from Defender
The channel Microsoft-Windows-Windows Defender/Operational is published by the Microsoft-Windows-Windows Defender provider. Its events can report Defender service status, scans, malware detections, and actions taken. Wazuh’s Windows logging documentation notes that System, Application, and Security are monitored by default; Defender is an additional channel to configure. Wazuh: configuring log collection for different operating systems
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Network Security, Firewalls, and VPNs | $66.62 | Buy on Amazon |
| 2 |
|
Network Security, Firewalls, and VPNs: . (Issa) | $57.99 | Buy on Amazon |
| 3 |
|
TP-Link ER605, Wired Gigabit VPN Router | $49.99 | Buy on Amazon |
| 4 |
|
Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid | $32.54 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
This is Defender telemetry, not a complete record of everything happening on the endpoint. If your detection goals require broader process or network activity context, Sysmon is a separate source that can be collected from its own Operational channel. The two sources serve different purposes and can be used together. Wazuh: event logging on the Wazuh server
Before you configure the agent
- Install a Wazuh agent on the Windows endpoint and have administrator privileges for installation. Wazuh: deploying agents on Windows endpoints
- Choose whether to manage the configuration centrally or edit the agent’s local
ossec.conf. Use the approach that matches how you administer the endpoint or its agent group. - Check the effective agent configuration rather than assuming Defender is included among the default Windows channels.
Add the Defender event channel
Add this block to the Windows agent configuration:
<localfile>
<location>Microsoft-Windows-Windows Defender/Operational</location>
<log_format>eventchannel</log_format>
</localfile>The channel spelling and the eventchannel format must match. Wazuh documents both local configuration in the Windows agent’s ossec.conf and centralized configuration as supported routes. Wazuh: Windows Defender logs collection and malware detection
#1 Best Overall
Local configuration
- Open the Windows agent’s
ossec.confwith administrator permissions. - Place the
localfileblock alongside the other log-collection entries, save the file, and restart the Wazuh agent service so the change takes effect.
Centralized configuration
Deploy the equivalent localfile entry through your Wazuh centralized agent configuration for the intended endpoint or group. This avoids making the same local edit on each managed endpoint, but the change still needs to reach the agents before collection begins. Wazuh documents both methods; it does not prescribe one as best for every environment.
Check that Defender events reach Wazuh
- Confirm the configuration contains the exact channel name and
eventchannelformat, and that a local change was followed by an agent-service restart. - Review alerts on the Wazuh manager in
alerts.logoralerts.json, or open the Wazuh dashboard and inspect the endpoint’s alerts. - Look for Defender-related event details, such as a scan, service-status change, detection, or action. The Wazuh guide includes a malware-detection alert as an example; your endpoint’s output depends on the events it generates and the rules that match them.
Wazuh supplies Windows Defender decoders and baseline rules, including the server-side rules file 0600-win-wdefender_rules.xml. That built-in support is a starting point, not a guarantee that every organization-specific event or policy has a dedicated alert. If you need different thresholds, fields, or response logic, add and validate rules for your own requirements. Wazuh: Windows Defender logs collection and malware detection
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
Decide whether to add Sysmon
Collect Defender alone when the immediate goal is visibility into antivirus activity and detections. Consider adding Sysmon when investigations or detections also need the process and system activity that Defender’s event channel does not aim to provide. Sysmon requires its own endpoint telemetry and channel configuration; it is not a substitute for the Defender channel. Wazuh’s documentation demonstrates collection of Sysmon/Operational, but does not establish a universal recommendation or quantify performance and data-volume trade-offs. Wazuh: event logging on the Wazuh server
Quick Recap
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
