Files in this Management Pack The Management Pack for Defender 2016 includes the following files: Windows Defender Management Pack Management Pack Purpose In this section:   For details on the discoveries, rules, monitors, views, and reports contained in this Management pack, see . Monitoring Scenarios The Windows Defender Management Pack monitor a few key components that are important to Windows Defender health. Monitoring scenario Description Associated rules and monitors (non-alerting rule) Real-time Realtime This scenario checks to see if protection on Protection(RTPStatus) real-time protection is turned on. Realtime protection (Error alerting rule) protection off constantly monitors the agent for malicious activity (non-alerting rule) AM Antimalware Status This scenario checks to see if service is running (AMStatus) the antimalware service is running. (Error alerting rule) AM service is not (non-alerting rule) Antimalware Definitions This scenario will monitor the Antimalware definitions Status age of the antimalware days aren’t older than 3 (AntimalwareDefinitions) definitions to see how up to (warning alerting rule) date they are. Antimalware definitions are older than 3 days (critical alerting rule) Antimalware definitions are older than 7 days Note:Days are user (non-alerting rule) Quick Antimalware Scan Status This scenario will monitor scan has happened within 3 how long ago a scan (AntimalwareScan) days occurred. This will monitor the
Files in this Management Pack The Management Pack for Defender 2016 includes the following files: Windows Defender Management Pack Management Pack Purpose In this section:   For details on the discoveries, rules, monitors, views, and reports contained in this Management pack, see . Monitoring Scenarios The Windows Defender Management Pack monitor a few key components that are important to Windows Defender health. Monitoring scenario Description Associated rules and monitors Realtime Protection(RTPStatus) This scenario checks to see if real-time protection is turned on. Realtime protection constantly monitors the agent for malicious activity (non-alerting rule) Real-time protection on (Error alerting rule) protection off Antimalware Status (AMStatus) This scenario checks to see if the antimalware service is running. (non-alerting rule) AM service is running (Error alerting rule) AM service is not Antimalware Definitions Status (AntimalwareDefinitions) This scenario will monitor the age of the antimalware definitions to see how up to date they are. (non-alerting rule) Antimalware definitions aren’t older than 3 days (warning alerting rule) Antimalware definitions are older than 3 days (critical alerting rule) Antimalware definitions are older than 7 days Note:Days are user Antimalware Scan Status (AntimalwareScan) This scenario will monitor how long ago a scan occurred. This will monitor the (non-alerting rule) Quick scan has happened within 3 days