Prerequisites The following requirements must be met to run this management pack: Installation of System Center Operations Manager and the Microsoft Windows Defender Management Pack in this Management Pack The Management Pack for Windows Defender includes the following files: Windows Defender Management Pack  Management Pack Purpose In this section:   For details on the discoveries, rules, monitors, views, and reports contained in this Management pack, see . Monitoring Scenarios The Windows Defender Management Pack monitors a few key components that are important to Windows Defender health. Monitoring scenario Description Associated rules and monitors (non-alerting rule) Real-time Realtime This scenario checks to see if  protection on Protection(RTPStatus) real-time protection is turned on. Realtime protection alerting rule) Real-time  protection off constantly monitors the agent for malicious activity  (non-alerting rule) AM Antimalware Status This scenario checks to see if service is running (AMStatus) the antimalware service is running. (Error alerting rule) AM  service is not running (non-alerting rule)  Antimalware Definitions This scenario will monitor the Antimalware definitions Status age of the antimalware aren’t older than 3 days (AntimalwareDefinitions) definitions to see how up to  (warning alerting rule) date they are. Antimalware definitions are older than 3 days
Prerequisites The following requirements must be met to run this management pack: Installation of System Center Operations Manager and the Microsoft Windows Defender Management Pack in this Management Pack The Management Pack for Windows Defender includes the following files:  Windows Defender Management Pack Management Pack Purpose In this section:   For details on the discoveries, rules, monitors, views, and reports contained in this Management pack, see . Monitoring Scenarios The Windows Defender Management Pack monitors a few key components that are important to Windows Defender health. Monitoring scenario Description Associated rules and monitors Realtime Protection(RTPStatus) This scenario checks to see if real-time protection is turned on. Realtime protection constantly monitors the agent for malicious activity  (non-alerting rule) Real-time protection on  alerting rule) Real-time protection off Antimalware Status (AMStatus) This scenario checks to see if the antimalware service is running.  (non-alerting rule) AM service is running  (Error alerting rule) AM service is not running Antimalware Definitions Status (AntimalwareDefinitions) This scenario will monitor the age of the antimalware definitions to see how up to date they are.  (non-alerting rule) Antimalware definitions aren’t older than 3 days  (warning alerting rule) Antimalware definitions are older than 3 days
Microsoft%20System%20Center%202016%20Management%20Pack%20for%20Windows%20Defender%20Guide.docx