Windows Defender Splunk AV Detection Dashboard 

This project demonstrates how I used Windows Defender event logs to create a structured detection dashboard in Splunk. The goal was to simulate real-world antivirus monitoring by ingesting logs (including test EICAR alerts), extracting key fields, and visualising threat data for easier analysis.

Panels Included:

1. Top Infected Paths

   • Identifies the most common directories where malware samples were detected (e.g., Downloads, Temp).

   • Provides visibility into risky user behaviour or persistence attempts.

2. Top Threat Names

   • Displays the most frequently triggered malware signatures.

   • Useful for understanding the types of threats targeting the endpoint.
     
     

Detection Over Time by Path

2. • Time-based visualisation showing how often detections occurred in specific file paths.

   • Helps to spot trends and burst activity.

3. Action Taken vs Path

   • Correlates Windows Defender actions (Quarantine, Remove, Allow) with the file paths of detections.

   • Helps verify if remediation is effective or if threats are recurring.

4. Correlation (Path + ThreatID)

   • Provides deeper context by linking malware signatures (ThreatIDs) to their locations.

   • Shows whether certain directories are prone to repeated infections by the same family.

5. Threats by Path (Combined)

   • A combined view of both threat name and path, giving analysts a complete picture of what type of threat appeared where.
     
     

Outcome:
This project highlights my ability to:

• Collect and analyse Windows Defender logs.

• Translate raw AV telemetry into actionable dashboards.

• Apply a SOC-style mindset in correlating threat behaviour.