I am not yet 100% sure why this is happening but it’s related to WSUS trying to repair itself. To view these events, click Log Search > Virus Alert.I have seen several times, that my WSUS server is suddently gone when the SUP role is installed locally on the Config Mgr site server. To view these events, click Log Search > Unparsed Data.Įvent codes that flow into the Virus Alert log setġ006, 1007, 1008, 1015, 1116, 1117, 1118, 1119
The Insight Agent recognizes certain event codes and sends them to InsightIDR where they flow into the Virus Alert log set. Windows Defender events that are not recognized by the Insight Agent are sent to the Unparsed Data log set. Windows Defender logs flow into different log sets depending on the event. There is no event source to add and no configuration required in InsightIDR. If the Insight Agent finds new events being written to this Windows event log, then the Insight Agent will collect them and send them to InsightIDR. You can read more about this Microsoft Windows event log at. You can view this event log on a Windows host with the Event Viewer under Applications and Services Logs > Microsoft > Windows > Microsoft Defender Antivirus > Operational.
On all Windows endpoints where the Rapid7 Insight Agent is installed, the agent collects the log entries from the Defender Antivirus operational Windows event log. If you are using Microsoft System Center Endpoint Protection (SCEP) and the events are written to the Windows Defender Antivirus operational log, then these events are collected in the same manner for Microsoft SCEP as for Windows Defender. Microsoft System Center Endpoint Protection Events
0 kommentar(er)
