Protection

Kind

State - something true when Signal read the host

Built-in rules reading it

0

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.state

string

A product's state as Windows Security Center reports it now: on, off, snoozed, expired.
derived: decoded by Signal from Security Center's productState - a bit layout Microsoft does not document (the community's reading); unknown values are left as the number

av.up_to_date

bool

Whether Windows Security Center reports a product's definitions as up to date.
derived: decoded by Signal from Security Center's productState (undocumented, as av.state)

av.program

string

The product's signed executable as registered with Security Center (Microsoft Defender's is windowsdefender://, not a file).

Kind

State - something true when Signal read the host

Built-in rules reading it

1

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.mode

string

The product's running mode: for Microsoft Defender Normal (the active antivirus), Passive (another product is active; Defender only scans on demand), EDR Block, SxS Passive, Not running.

av.real_time

string

Whether real-time protection is on now: on or off.

av.behavior_monitoring

string

Whether behaviour monitoring is on now: on or off.

av.download_scanning

string

Whether downloaded files and attachments are scanned now (Defender's IOAV protection): on or off.

av.on_access

string

Whether files are scanned when opened now (on-access protection): on or off.

av.tamper_protection

string

Whether Tamper Protection is on now (protected settings cannot be changed outside the product's own management): on or off.

av.cloud

string

Cloud-delivered protection (Defender's MAPS membership) now: off, basic or advanced.
derived: named by Signal from MAPSReporting (0, 1, 2)

av.intelligence_age

int

How many days old the product's security intelligence (definitions) is, as the product reports it.

av.intelligence_version

string

The product's security intelligence version.

av.platform_version

string

The product's platform (client) version.

av.passive_reason

string

Why Microsoft Defender Antivirus is passive, when it is: forced by policy (ForceDefenderPassiveMode, set for Defender for Endpoint with another antivirus) - else it stood down for another product Windows Security Center registered.

av.asr_rules

string

The attack surface reduction rules configured, each by name, grouped by mode (block, warn, audit, off) - "none configured" when there are none.

av.controlled_folder_access

string

Controlled folder access (protected folders guarded from unknown programs - against ransomware): off, block, audit, or a mode for disks only.

av.network_protection

string

Network protection (connections to known malicious or low-reputation addresses blocked): off, block or audit.

av.pua_protection

string

Potentially unwanted application protection (adware, bundlers, coin miners): off, block or audit.

Kind

State - something true when Signal read the host

Built-in rules reading it

1

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.exclusion_kind

string

What an exclusion leaves unscanned: path (a file or folder), extension, process (files the process opens), ip address (network inspection).

av.exclusion

string

An exclusion configured now, exactly as configured (a path, an extension, a process name or path, an address) - environment variables and wildcards unexpanded.

Kind

Event - something that happened at a time

Its time is

threat detected

Built-in rules reading it

6

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.detection_id

string

The product's identifier of one detection: every event about that detection (detected, action taken, action failed) carries it.

av.detected

time

When a detection's first event was recorded.

av.threat

string

The threat's name as the product names it (e.g. Trojan:Win32/...): the product's verdict, not proof of what the file does.

av.threat_id

string

The product's numeric identifier of the threat - the key its per-threat settings (a default action) use.

av.severity

string

The threat's severity as the product rates it: low, moderate, high, severe.
derived: named by Signal in English from the event's Severity ID

av.category

string

The threat's category as the product names it (Trojan, Tool, Potentially Unwanted Software...), possibly in the host's display language.

av.path

string

What was detected: one or more files (separated by "; "), or another resource the product names with its kind (a process, a registry key, a web download, a behaviour).
derived: taken by Signal from the event's Path, with the file:_ prefix the product puts before a file removed

av.process

string

The process that touched the detected item, as the product records it - often the one that wrote or opened the file, not necessarily the threat itself.

av.user

string

The account in whose context a detection happened (the product's Detection User).

av.action

string

What the product did, or was told to do, with a detection: cleaned, quarantined, removed, allowed, user defined, no action, blocked.
derived: named by Signal in English from the event's Action ID

av.outcome

string

What became of a detection, from all of its events: remediated (cleaned, quarantined, removed or blocked), remediation failed, allowed (or no action, by choice), or no action recorded (a detection with no later event in the log - not proof that nothing was done).
derived: set by Signal from the last action event of the detection's events (1117 action taken, 1118/1119 action failed)

av.error

string

Why a remediation failed, as the product describes it.

av.events

string

Which of the product's events recorded a detection, e.g. "1116, 1117" (detected, then action taken).
derived: set by Signal when it merges the events of one detection (the same detection ID)

av.returned

bool

Whether the same threat was detected on the same file or resource before, in the log's window, and remediated then: it came back.
derived: compared by Signal across the window's detections

av.detection_source

string

What found the threat, as Defender records it (its log's Source Name, its history's source): real-time protection, a scan the user or the system ran, a downloaded file's scan, AMSI (a script's or macro's content as it ran - after any decoding), early launch, UAC.

Kind

State - something true when Signal read the host

Its time is

threat detected

Built-in rules reading it

6

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.detection_id

string

The product's identifier of one detection: every event about that detection (detected, action taken, action failed) carries it.

av.detected

time

When a detection's first event was recorded.

av.threat

string

The threat's name as the product names it (e.g. Trojan:Win32/...): the product's verdict, not proof of what the file does.

av.threat_id

string

The product's numeric identifier of the threat - the key its per-threat settings (a default action) use.

av.severity

string

The threat's severity as the product rates it: low, moderate, high, severe.
derived: named by Signal in English from the event's Severity ID

av.path

string

What was detected: one or more files (separated by "; "), or another resource the product names with its kind (a process, a registry key, a web download, a behaviour).
derived: taken by Signal from the event's Path, with the file:_ prefix the product puts before a file removed

av.process

string

The process that touched the detected item, as the product records it - often the one that wrote or opened the file, not necessarily the threat itself.

av.user

string

The account in whose context a detection happened (the product's Detection User).

av.detection_source

string

What found the threat, as Defender records it (its log's Source Name, its history's source): real-time protection, a scan the user or the system ran, a downloaded file's scan, AMSI (a script's or macro's content as it ran - after any decoding), early launch, UAC.

av.action

string

What the product did, or was told to do, with a detection: cleaned, quarantined, removed, allowed, user defined, no action, blocked.
derived: named by Signal in English from the event's Action ID

av.outcome

string

What became of a detection, from all of its events: remediated (cleaned, quarantined, removed or blocked), remediation failed, allowed (or no action, by choice), or no action recorded (a detection with no later event in the log - not proof that nothing was done).
derived: set by Signal from the last action event of the detection's events (1117 action taken, 1118/1119 action failed)

av.returned

bool

Whether the same threat was detected on the same file or resource before, in the log's window, and remediated then: it came back.
derived: compared by Signal across the window's detections

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

9

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.event

string

What a protection event records, in words: real-time protection turned off or on, a protection feature's configuration changed, a setting changed, scanning turned off, Tamper Protection reverted a change, an item restored from quarantine.
derived: named by Signal in English from the event's ID

av.event_time

time

When a protection event was recorded.

log.event_id

int

The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".

av.setting

string

The setting a change touched: its registry key and value name (for Microsoft Defender, HKLM\SOFTWARE\Microsoft\Windows Defender\..., or the policy key) - an exclusion's own path is part of the name of the value under Exclusions.
derived: taken by Signal from the event's New Value (or Old Value, for a removal): the part before " = "

av.old_value

string

A changed setting's value before the change, as the product records it (e.g. 0x0); empty for a setting that was added.

av.new_value

string

A changed setting's value after the change, as the product records it (e.g. 0x1); empty for a setting that was removed.

av.change

string

How a setting changed: added, removed, or changed; for a change Tamper Protection reverted, the product's own word for it (reverted) and the values the event records.
derived: set by Signal from which of the event's Old Value and New Value is empty (Tamper Protection: its Changed Type and Value)

av.feature

string

The real-time protection feature whose configuration changed (5004's Feature Name), with its new configuration.

av.threat

string

The threat's name as the product names it (e.g. Trojan:Win32/...): the product's verdict, not proof of what the file does.

av.path

string

What was detected: one or more files (separated by "; "), or another resource the product names with its kind (a process, a registry key, a web download, a behaviour).
derived: taken by Signal from the event's Path, with the file:_ prefix the product puts before a file removed

av.user

string

The account in whose context a detection happened (the product's Detection User).

av.process

string

The process that touched the detected item, as the product records it - often the one that wrote or opened the file, not necessarily the threat itself.

av.error

string

Why a remediation failed, as the product describes it.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

2

av.product

string

The antivirus product a record is about, as it names itself (Microsoft Defender Antivirus; a third-party product's display name in Windows Security Center).

av.block_kind

string

Which protection acted: Defender's attack surface reduction (a rule against a technique - Office starting programs, credential theft from LSASS...), controlled folder access (a program writing to a protected folder) or network protection (a connection); code integrity (a driver or file that did not meet the signing policy - App Control for Business, the vulnerable driver blocklist); AppLocker (a program or script its policy does not allow).

av.block_mode

string

blocked - the operation was stopped; audited - it was allowed, recorded as one the protection would have stopped (the protection is in audit mode).

av.rule

string

The attack surface reduction rule that acted, by its name (its GUID when Signal does not know it).

av.process

string

The process that touched the detected item, as the product records it - often the one that wrote or opened the file, not necessarily the threat itself.

av.target

string

What the protection acted on: the file or folder written (controlled folder access), the address connected to (network protection), the command line or file involved (attack surface reduction).

av.user

string

The account in whose context a detection happened (the product's Detection User).

av.event_time

time

When a protection event was recorded.

log.event_id

int

The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".

Kind

State - something true when Signal read the host

Built-in rules reading it

4

protection.name

string

A protection Windows has, named for what it protects against: the firewall's profiles, LSA protection, Credential Guard, memory integrity, the vulnerable driver blocklist, WDigest not keeping clear-text passwords, User Account Control, remote UAC for local accounts, SMBv1 off, LLMNR off, AppLocker, BitLocker, Defender for Endpoint.

protection.state

string

Whether the protection is on now: on, off, audit (records, does not stop), or unknown - a value that could not be read, or one whose absence means different things on different Windows builds.

protection.detail

string

The value the state was read from, where, and what its absence means.

protection.set_by

string

Group Policy when the value is in a policy key (Administrative Templates, local or domain GPO - LogIntegrity's logging_policy and Directory name which), else the host's own setting.