Created
November 25, 2021 13:05
-
-
Save f-bader/68a863c3001b1638bfabebbe3b4dee46 to your computer and use it in GitHub Desktop.
Advanced hunting query to check on a few vital Defender AV health settings
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Check Defender AV related health issues | |
| // Microsoft Defender Antivirus is disabled - scid-2010 | |
| // Microsoft Defender Antivirus definitions are outdated - scid-2011 | |
| // Microsoft Defender Antivirus real-time behavior monitoring is disabled - scid-91 | |
| // Microsoft Defender Antivirus real-time protection is disabled - scid-2012 | |
| // Microsoft Defender Antivirus cloud service connectivity is impaired - scid-2014 | |
| DeviceTvmSecureConfigurationAssessmentKB | |
| | where ConfigurationName contains "Defender" | |
| | join kind=innerunique DeviceTvmSecureConfigurationAssessment on ConfigurationId | |
| | where ConfigurationId in ("scid-2010","scid-2011","scid-2012","scid-91","scid-2014") | |
| | where IsApplicable == 1 and IsCompliant != 1 | |
| | project ConfigurationName, DeviceName, OSPlatform ,ConfigurationId,ConfigurationImpact | |
| | sort by ConfigurationImpact |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment