Windows Defender Integration

Windows Defender

Version: Windows 10 and Windows Server 2016.

Windows Defender is known as Windows Defender antivirus in Windows 10 (Creators update) and later, is an anti-malware component of Microsoft Windows. It has evolved into a full antivirus program, replacing Microsoft Security Essentials as a part of Windows 8 and later versions.

Netsurion collects the event logs delivered from Windows Defender and filters them out to get some critical event types for creating a report, dashboard, saved searches and alerts. Among the event types, we are considering: Threat detection, Suspicious behavior detection, Configuration change and action taken on threats.

Netsurion monitors all the Windows Defender events which are given as below.

Security – Threat detected, Action taken on threats, Suspicious behavior detected.
Operations – Configuration changes, Windows Defender disabled, Windows Defender signature update failed.

Once events are received into Netsurion, Reports, Knowledge Objects, Categories and Dashboards can be configured into Netsurion.

Some of the Data Source Integrations available in Netsurion are listed below.

Alerts

Type	Name	Description
Security	Windows Defender - Malware detected	This alert is generated when the anti-malware engine finds malware or other potentially unwanted software.
Security	Windows Defender – Action taken on threats	This event will be triggered when action is taken on the threat.
Security	Windows Defender - Suspicious behavior detected	This alert is generated when Windows Defender antivirus has detected suspicious behavior.
Operations	Windows Defender - Definition update failed	This alert is generated when Windows Defender antivirus has encountered an error trying to use Dynamic Signature Service or update, load signatures and attempt reverting to a known-good set of signatures.
Operations	Windows Defender – Signature update failed	This alert will be triggered when the signature update fails on Windows Defender.
Operations	Windows Defender - Action taken on malware failed	This alert is generated when Windows Defender antivirus has encountered a non-critical error when acting on malware or other potentially unwanted software.
Operations	Windows Defender - Engine update failed	This alert is generated when Windows Defender antivirus has encountered an error while trying to update the engine, could not load anti-malware engine and update the platform.

Reports

Type	Name	Description
Security	Windows Defender - Threat detected	This report provides information related to threat detected in windows machine. It provides information about the threat name, it’s category, what action was taken by the defender on that threat.
Security	Windows Defender - Suspicious behavior detected	This report provides information when the defender has detected some suspicious behavior in windows machine like usage of malicious macro, changes in the registry which can compromise the system.
Security	Windows Defender - Action taken on threats	This report provides information related to the action taken by the Windows Defender on the threats detected on the system. If action has failed, then this report will provide the detail of reason.
Operations	Windows Defender – Configuration changed	This report provides information related to changes happened on Windows Defender features like enabling/disabling of real-time protection, changes in the configuration of the defender.

Documentation

The configuration details are consistent with Netsurion version 9.X and later, and Windows Defender Windows 10 and Windows server 2016.

Download Integration Guide and How-to Guide for more information and to configuration instructions.