Art der AntiMalware-Modulüberwachung von Microsoft Forefront Endpoint Protection Security

Microsoft.FEP.SecurityVulnerability.AMEngineMonitorType (UnitMonitorType)

Element properties:

Member Modules:

Overrideable Parameters:

Source Code:

<UnitMonitorType ID="Microsoft.FEP.SecurityVulnerability.AMEngineMonitorType" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="Enabled" NoDetection="false"/>

    <MonitorTypeState ID="Disabled" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <xsd:element minOccurs="1" name="ComputerName" type="xsd:string"/>

    <xsd:element minOccurs="1" name="DelayTime" type="xsd:positiveInteger"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="DelayTime" Selector="$Config/DelayTime$" ParameterType="int"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="EventDS" TypeID="Microsoft.FEP.ProtectedServer.AMEngineEventDSType"/>

      <ProbeAction ID="WMIProbe" TypeID="Microsoft.FEP.AntimalwareWMIProbeActionModuleType">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <DelayTime>$Config/DelayTime$</DelayTime>

        <MonitorName>AM Engine</MonitorName>

      </ProbeAction>

      <ConditionDetection ID="AMEnabledCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='ProductStatus']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='ProductStatus']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">2</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="AMDisabledCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='ProductStatus']</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="Integer">1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='ProductStatus']</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="Integer">2</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="Enabled">

        <Node ID="AMEnabledCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Disabled">

        <Node ID="AMDisabledCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

    <OnDemandDetections>

      <OnDemandDetection MonitorTypeStateID="Enabled">

        <Node ID="AMEnabledCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Disabled">

        <Node ID="AMDisabledCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

    </OnDemandDetections>

  </MonitorImplementation>

</UnitMonitorType>