Asking Splunk and Defender for Endpoint the same question

Alongside my SIEM design, I explored an additional Splunk instance and a Microsoft Defender for Endpoint free trial. They are not stages in one pipeline. They are two separate ways of looking at the same Windows endpoints, and putting them next to each other is the point of this entry.

The scenario is redacted and the results are samples on the simulated fixture. The Splunk host and version, the trial dates, the onboarded devices and the sensor version are not in my records yet, so I keep them out rather than guess.

Redacted scenario · sample results on the simulated fixture

Splunk

Data source: Windows Security event log, indexed as WinEventLog:Security
How data arrives: Universal Forwarder on the endpoint reads the channel and sends events to the indexer
Query: index=wineventlog EventCode=4625 | stats count by Account_Name, Workstation_Name
Sample result: student01 · WS-02 · 7
What it reveals: Every raw event, on the host that recorded it, with fields I can regroup any way I like
What it misses: Anything I did not collect: no process tree, no device context outside the log

Defender for Endpoint

Data source: DeviceLogonEvents and DeviceProcessEvents from the endpoint sensor
How data arrives: Onboarded device reports to the Microsoft portal; queried with advanced hunting
Query: DeviceLogonEvents | where ActionType == "LogonFailed" | summarize count() by DeviceName, AccountName
Sample result: fs-01 · student01 · 7
What it reveals: The device timeline around the failures: which process opened the share, what else ran
What it misses: Devices that were never onboarded, and the firewall side of the story

Same seven failures, two sources. Splunk shows the raw events the file server wrote; Defender shows what the device sensor saw around them. Neither shows the firewall side, which is why the SOC case keeps the Sophos records separate.

I do not draw an integration between them. Each view gets its data on its own, and that independence is what makes comparing them useful.

Splunk: searching the events myself

cmdWindows endpoint · Universal ForwarderExample output · substituted names and addresses

Purpose: show which channels the forwarder reads

Before trusting a search that returned nothing, I check that the forwarder is reading the channel at all.

type "%ProgramFiles%SplunkUniversalForwarderetcsystemlocalinputs.conf"

Show output

[WinEventLog://Security]
disabled = 0
index = wineventlog
renderXml = false

disabled = 0 the Security channel is collected; a 1 here would explain an empty search
index = wineventlog the index the SPL below searches

Example input stanza. This is the standard way a Universal Forwarder reads the Security channel.

Splunk is closest to the raw evidence. Windows event logs reach it through an input, usually a Universal Forwarder on the endpoint watching the Security channel. Once indexed, every event is searchable with SPL, and the question I ask is the one I wrote in the search bar.

SPLSplunk search · lab indexExample output · substituted names and addresses

I wanted the same failed-logon cluster the SIEM flagged, but grouped my own way: by account and the workstation it came from.

index=wineventlog EventCode=4625 earliest=-24h
| stats count, values(Logon_Type) AS logon_types, latest(_time) AS last BY Account_Name, Workstation_Name
| where count >= 5
| sort - count

Show output

Account_Name   Workstation_Name  count  logon_types  last
student01      WS-02             7      3            2026-11-07 08:20

Example output on the simulated fixture. Field names depend on the add-on that parses the events; these follow the common Windows add-on.

Defender for Endpoint: the device’s own story

PowerShellOnboarded Windows device · adminExample output · substituted names and addresses

Purpose: confirm the sensor is running, and its versions

An empty device timeline means nothing until I know the sensor on that device is actually running.

Get-Service -Name Sense | Select-Object Status, StartType; Get-MpComputerStatus | Select-Object AMProductVersion, AMRunningMode

Show output

Status  StartType
------  ---------
Running Automatic

AMProductVersion AMRunningMode
---------------- -------------
4.18.xxxxx.x     Normal

Sense the Defender for Endpoint sensor service; Defender antivirus alone does not report to the portal
4.18.xxxxx.x version redacted: I record it separately from which devices are onboarded

Example output. This is the endpoint side; the portal side is the device inventory.

Defender starts from the device. After onboarding (a package or script that registers the machine with the tenant), each device gets a timeline of process, network, logon and file events correlated by Microsoft’s sensor. Advanced hunting queries those tables with KQL. It runs in Microsoft’s cloud, not in the lab. The console shows it in the SOC role because that is where I used it. on its own line from the Windows endpoints.

KQLDefender portal · advanced huntingExample output · substituted names and addresses

I wanted to see whether the device sensor counted the same failures Splunk did, and what it knew about the remote machine.

DeviceLogonEvents
| where Timestamp > ago(24h) and ActionType == "LogonFailed"
| summarize Failures = count(), Last = max(Timestamp) by DeviceName, AccountName, RemoteDeviceName
| where Failures >= 5

Show output

DeviceName  AccountName  RemoteDeviceName  Failures  Last
fs-01       student01    ws-02             7         2026-11-07T08:20:00Z

Example output. Table and column names are from the advanced hunting schema.

What each view was better at

Question	Splunk	Defender for Endpoint
Show me every raw event that matched	Strong: the event is the record	Summarised into tables
What else happened on that device around then	Only what I collected	Strong: the device timeline
Can I write my own correlation	Strong: SPL over any index	KQL over Microsoft’s schema
Does it need anything in my lab	An input or forwarder	Onboarding, then the cloud

When the two agree, as they do on this sample, I trust the count. When they disagree, the difference usually points at collection: a channel Splunk was not reading, or a device Defender never onboarded. That is a more useful finding than either number alone.

Takeaway: run the same question in both tools for the same window. A matching count builds trust in both; a mismatch tells you which collection to fix first.

Further reading: Monitor Windows event log data with Splunk Enterprise · Onboard devices to Defender for Endpoint · Advanced hunting overview

Skills used

Writing the same query in SPL and KQL
Noting where two views of one endpoint differ

All skills, grouped by what job postings ask for

Tools in this entry

Splunk Enterprise I use it
Official documentation for Splunk Enterprise
Microsoft Defender for Endpoint I use it
Official documentation for Microsoft Defender for Endpoint
Windows security auditing I use it
Official documentation for Windows security auditing

Every tool and its documentation