| DisplayName | ID | Target | Category | Enabled | Alert Generate |
| Antigen Service Discovery | Antigen_Service_Discovery_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| Antigen Service Discovery | Antigen_Service_Discovery_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| OnVirusOutbreakAlert | OnVirusOutbreakAlert_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | False | True |
| ScanConfigDataAccess | ScanConfigDataAccess_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanConfigDataAccess | ScanConfigDataAccess_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternalError | ScanInternalError_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternalError | ScanInternalError_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternetAbort | ScanInternetAbort_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternetAbort | ScanInternetAbort_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternetCountAttachmentClean | ScanInternetCountAttachmentClean_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentClean | ScanInternetCountAttachmentClean_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentDetect | ScanInternetCountAttachmentDetect_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentDetect | ScanInternetCountAttachmentDetect_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentRemove | ScanInternetCountAttachmentRemove_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentRemove | ScanInternetCountAttachmentRemove_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentScan | ScanInternetCountAttachmentScan_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountAttachmentScan | ScanInternetCountAttachmentScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessageDetect | ScanInternetCountMessageDetect_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessageDetect | ScanInternetCountMessageDetect_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessagePurge | ScanInternetCountMessagePurge_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessagePurge | ScanInternetCountMessagePurge_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessageScan | ScanInternetCountMessageScan_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessageScan | ScanInternetCountMessageScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessageTag | ScanInternetCountMessageTag_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetCountMessageTag | ScanInternetCountMessageTag_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetDisabled | ScanInternetDisabled_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternetDisabled | ScanInternetDisabled_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternetEnabled | ScanInternetEnabled_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| ScanInternetEnabled | ScanInternetEnabled_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ScanInternetEngineMap | ScanInternetEngineMap_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternetEngineMap | ScanInternetEngineMap_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternetInternalError | ScanInternetInternalError_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternetInternalError | ScanInternetInternalError_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternetProcessError | ScanInternetProcessError_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | False | True |
| ScanInternetProcessError | ScanInternetProcessError_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | False | True |
| ScanInternetProcessPoll | ScanInternetProcessPoll_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | False | False |
| ScanInternetProcessPoll | ScanInternetProcessPoll_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | False | False |
| ScanInternetRateAttachmentScan | ScanInternetRateAttachmentScan_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | PerformanceCollection | True | False |
| ScanInternetRateAttachmentScan | ScanInternetRateAttachmentScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanInternetSink | ScanInternetSink_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternetSink | ScanInternetSink_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanInternetTimeout | ScanInternetTimeout_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ScanInternetTimeout | ScanInternetTimeout_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanManualCountAttachmentClean | ScanManualCountAttachmentClean_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualCountAttachmentDetect | ScanManualCountAttachmentDetect_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualCountAttachmentRemove | ScanManualCountAttachmentRemove_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualCountAttachmentScan | ScanManualCountAttachmentScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualCountMessageDetect | ScanManualCountMessageDetect_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualCountMessageScan | ScanManualCountMessageScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualCountMessageTag | ScanManualCountMessageTag_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualEngineMapE | ScanManualEngineMapE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanManualFailedE | ScanManualFailedE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanManualProblemE | ScanManualProblemE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanManualRateAttachmentScan | ScanManualRateAttachmentScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanManualStartedE | ScanManualStartedE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ScanManualStoppedE | ScanManualStoppedE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ScanRealtimeAbortE | ScanRealtimeAbortE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanRealtimeCountAttachmentClean | ScanRealtimeCountAttachmentClean_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountAttachmentDetect | ScanRealtimeCountAttachmentDetect_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountAttachmentRemove | ScanRealtimeCountAttachmentRemove_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountAttachmentScan | ScanRealtimeCountAttachmentScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountMessageDetect | ScanRealtimeCountMessageDetect_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountMessagePurge | ScanRealtimeCountMessagePurge_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountMessageScan | ScanRealtimeCountMessageScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeCountMessageTag | ScanRealtimeCountMessageTag_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeDisabledE | ScanRealtimeDisabledE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanRealtimeEnabledE | ScanRealtimeEnabledE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ScanRealtimeEngineMapE | ScanRealtimeEngineMapE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanRealtimeProcessError | ScanRealtimeProcessError_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanRealtimeProcessPollE | ScanRealtimeProcessPollE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | False | False |
| ScanRealtimeProcessUsage | ScanRealtimeProcessUsage_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeRateAttachmentScan | ScanRealtimeRateAttachmentScan_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | PerformanceCollection | True | False |
| ScanRealtimeTimeoutE | ScanRealtimeTimeoutE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ScanUnapprovedVersionE | ScanUnapprovedVersionE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServiceAntigenStoreTerminateE | ServiceAntigenStoreTerminateE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenIMCStartFail | ServicesAntigenIMCStartFail_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesAntigenIMCStartFail | ServicesAntigenIMCStartFail_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenIMCStart | ServicesAntigenIMCStart_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| ServicesAntigenIMCStart | ServicesAntigenIMCStart_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesAntigenIMCStop | ServicesAntigenIMCStop_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| ServicesAntigenIMCStop | ServicesAntigenIMCStop_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesAntigenIMCTerminate | ServicesAntigenIMCTerminate_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesAntigenIMCTerminate | ServicesAntigenIMCTerminate_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenIMC StateMonitor | ServicesAntigenIMC_StateMonitor_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesAntigenIMC StateMonitor | ServicesAntigenIMC_StateMonitor_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenMonitor StateMonitor | ServicesAntigenMonitor_StateMonitor_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesAntigenMonitor StateMonitor | ServicesAntigenMonitor_StateMonitor_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenService StateMonitor | ServicesAntigenService_StateMonitor_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesAntigenService StateMonitor | ServicesAntigenService_StateMonitor_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenStoreEvent StateMonitor | ServicesAntigenStoreEvent_StateMonitor_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenStoreStartE | ServicesAntigenStoreStartE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesAntigenStoreStartFailE | ServicesAntigenStoreStartFailE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesAntigenStoreStopE | ServicesAntigenStoreStopE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesAntigenStore StateMonitor | ServicesAntigenStore_StateMonitor_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesSMTPStartE | ServicesSMTPStartE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | False | False |
| ServicesSMTPStartFail | ServicesSMTPStartFail_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesSMTPStartFail | ServicesSMTPStartFail_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesSMTPStart | ServicesSMTPStart_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| ServicesSMTPStart | ServicesSMTPStart_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesSMTPStopE | ServicesSMTPStopE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | False | False |
| ServicesSMTPStop | ServicesSMTPStop_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| ServicesSMTPStop | ServicesSMTPStop_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesSMTPTerminate | ServicesSMTPTerminate_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| ServicesSMTPTerminate | ServicesSMTPTerminate_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesStoreFailE | ServicesStoreFailE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| ServicesStoreStartE | ServicesStoreStartE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| ServicesStoreStopE | ServicesStoreStopE_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| UpdateFailDisable | UpdateFailDisable_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| UpdateFailDisable | UpdateFailDisable_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| UpdateFailGeneric | UpdateFailGeneric_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| UpdateFailGeneric | UpdateFailGeneric_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| UpdateFailTimeout | UpdateFailTimeout_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| UpdateFailTimeout | UpdateFailTimeout_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| UpdateRollbackFail | UpdateRollbackFail_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | True |
| UpdateRollbackFail | UpdateRollbackFail_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | True |
| UpdateSuccessful | UpdateSuccessful_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| UpdateSuccessful | UpdateSuccessful_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |
| UpdateSuccess | UpdateSuccess_1_Rule | Microsoft.Antigen.v9.Antigen_For_SMTP_Installation | EventCollection | True | False |
| UpdateSuccess | UpdateSuccess_2_Rule | Microsoft.Antigen.v9.Antigen_For_Exchange_Installation | EventCollection | True | False |