Microsoft Security Essentials Logs

So there may come a time when you need to know what has happened with your virus scans for reporting or anything really (for me it was reporting). Well when that happens here is how you can find your logs in Microsoft Security Essentials.

Microsoft Security Essentials (MSE) actually logs all of its scans and findings, although you can't find them in the program itself. It logs them to the event viewer.

There are a couple of options:

1) Find and create a filter for the specific logging you want.

2) There is a built in dump of all of the logs to one file called MpCmdRun

To run the built in option simply open an administrator command prompt and go to the directory where it is located. 

cd %programfiles%\Microsoft Security Essential

[add pic]

Then run "MpCmdRun.exe -getfiles"

It takes a bit to run sometimes depending on how often and how many logs there are.

It makes a file called MPSupportFiles.cab which will be saved automatically to "%ProgramData%\Microsoft\Microsoft Antimalware\Support\" folder

[add pic]

The other option lets you export an XML so you can then import that into MySQL or anything really. I will get a query once I test it out again.

You can also use the Event Viewer (Start > Run > eventvwr.msc) under [System] right click View > filter (by Event Source: Microsoft Antimalware) 

I usually make the filter for a week so I don't get too much data.

I filter out the update events but other than that here is the xml:

<ViewerConfig><QueryConfig><QueryParams><Simple><BySource>True</BySource><Channel>System</Channel><Source>Microsoft Antimalware</Source><RelativeTimeInfo>4</RelativeTimeInfo><EventId>-2000</EventId></Simple></QueryParams><QueryNode><Name>MSE Events</Name><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft Antimalware'] and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]]</Select><Suppress Path="System">*[System[(EventID=2000)]]</Suppress></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>

It is all in one line. To export it to a database it is easier to use powershell but that was a project in and of itself so I am not going to go over that in this post.