Home
  •  

Active Malware

Microsoft.FEP.ProtectedServer.ActiveMalware.Monitor (UnitMonitor)

This monitor tracks failed malware cleanup operations.

Knowledge Base article:

Summary

This monitor tracks failed malware cleanup operations. This monitor will report a Critical state if the client reports that it failed to clean the malware.

Configuration

It is advised to keep this alert turned on with the default configuration.

Resolutions

Follow the alert description. You may be required to launch a full scan, restart the computer, run an offline scan tool, or perform manual steps.

Element properties:

TargetMicrosoft.FEP.ProtectedServer
Parent MonitorMicrosoft.FEP.ProtectedServer.FEP.Aggregate.Monitor
CategorySecurityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.FEP.SecurityRootCause.MalwareActivity.ActiveMalwareMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Active Malware
The Forefront Endpoint Protection client failed to clean malware on this computer. Verify that the computer has the most up-to-date definitions and re-scan the computer. If malware still is present after re-scanning, it is recommended that you remove the malware manually.

Additional Actions: {6}

Malware Details:
Threat Name: {0}
Detection Time (GMT): {1}
Malware Severity: {2}
Category: {3}
More Information: {4}
Path: {5}
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.FEP.ProtectedServer.ActiveMalware.Monitor" Accessibility="Public" Enabled="true" Target="FEPLibrary!Microsoft.FEP.ProtectedServer" ParentMonitorID="Microsoft.FEP.ProtectedServer.FEP.Aggregate.Monitor" Remotable="true" Priority="Normal" TypeID="FEPLibrary!Microsoft.FEP.SecurityRootCause.MalwareActivity.ActiveMalwareMonitorType" ConfirmDelivery="true">

  <Category>SecurityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.FEP.ProtectedServer.ActiveMalware.Monitor.Alert">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Property[@Name='CriticallyFailedThreatName']$</AlertParameter1>

      <AlertParameter2>$Data/Context/Property[@Name='CriticallyFailedDetectionTime']$</AlertParameter2>

      <AlertParameter3>$Data/Context/Property[@Name='CriticallyFailedSeverity']$</AlertParameter3>

      <AlertParameter4>$Data/Context/Property[@Name='CriticallyFailedCategory']$</AlertParameter4>

      <AlertParameter5>$Data/Context/Property[@Name='CriticallyFailedFWLink']$</AlertParameter5>

      <AlertParameter6>$Data/Context/Property[@Name='CriticallyFailedPath']$</AlertParameter6>

      <AlertParameter7>$Data/Context/Property[@Name='CriticallyFailedAdditionalActions']$</AlertParameter7>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="NoMalware" MonitorTypeStateID="NoMalware" HealthState="Success"/>

    <OperationalState ID="ActiveMalware" MonitorTypeStateID="ActiveMalware" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <TimeoutSeconds>600</TimeoutSeconds>

  </Configuration>

</UnitMonitor>