name: Windows Event Log Defender
id: 4bae37e2-b347-4d76-b05d-f97066a8aa88
author: Patrick Bareiss, Splunk
source: WinEventLog:Microsoft-Windows-Windows Defender/Operational
sourcetype: xmlwineventlog
separator: EventCode
supported_TA:
  name: Splunk Add-on for Microsoft Windows
  version: 8.8.0
  url: https://splunkbase.splunk.com/app/742
event_names:
- event_name: Windows Event Log Defender 1121
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1121.yml
- event_name: Windows Event Log Defender 1122
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1122.yml
- event_name: Windows Event Log Defender 1125
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1125.yml
- event_name: Windows Event Log Defender 1126
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1126.yml
- event_name: Windows Event Log Defender 1129
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1129.yml
- event_name: Windows Event Log Defender 1131
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1131.yml
- event_name: Windows Event Log Defender 1132
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1132.yml
- event_name: Windows Event Log Defender 1133
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1133.yml
- event_name: Windows Event Log Defender 1134
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1134.yml
- event_name: Windows Event Log Defender 5007
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_5007.yml