Tipo de monitor de vigencia de definiciones de vulnerabilidad para la seguridad de Microsoft Forefront Endpoint Protection

Microsoft.FEP.SecurityVulnerability.AntimalwareDefinitionsDate.MonitorType (UnitMonitorType)

Element properties:

Show References:
- Unit Monitors (1)

RunAs	Default
Accessibility	Public
Support Monitor Recalculate	True

Member Modules:

ID	Module Type	TypeId	RunAs
EventDS	DataSource	Microsoft.FEP.ProtectedServer.AntimalwareDefinitionsEventDSType	Default
WMIProbe	ProbeAction	Microsoft.FEP.AntimalwareWMIProbeActionModuleType	Default
CriticalCondition	ConditionDetection	System.ExpressionFilter	Default
HealthyCondition	ConditionDetection	System.ExpressionFilter	Default
WarningCondition	ConditionDetection	System.ExpressionFilter	Default

Overrideable Parameters:

ID	ParameterType	Selector	Display Name	Description
DelayTime	int	$Config/DelayTime$	Tiempo de retraso (segundos)
AgeHealthyValue	int	$Config/AgeHealthyValue$	Vigencia de definiciones de estado Correcto (días)	Número de días en el que se considera que las definiciones son actuales. Las definiciones anteriores al número de días especificado se considera que no están actualizadas y, por lo tanto, en estado Advertencia. Se generará una alerta. El valor recomendado para este parámetro son tres días.
AgeCriticalValue	int	$Config/AgeCriticalValue$	Vigencia de definiciones de estado Crítico (días)	Número de días en el que se considera que las definiciones no actualizadas están en estado Crítico. Se generará una alerta. El valor recomendado para este parámetro son cinco días.

Source Code:

<UnitMonitorType ID="Microsoft.FEP.SecurityVulnerability.AntimalwareDefinitionsDate.MonitorType" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="Healthy" NoDetection="false"/>

    <MonitorTypeState ID="Warning" NoDetection="false"/>

    <MonitorTypeState ID="Critical" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <xsd:element minOccurs="1" name="ComputerName" type="xsd:string"/>

    <xsd:element minOccurs="1" name="DelayTime" type="xsd:positiveInteger"/>

    <xsd:element minOccurs="1" name="AgeHealthyValue" type="xsd:positiveInteger"/>

    <xsd:element minOccurs="1" name="AgeCriticalValue" type="xsd:positiveInteger"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="DelayTime" Selector="$Config/DelayTime$" ParameterType="int"/>

    <OverrideableParameter ID="AgeHealthyValue" Selector="$Config/AgeHealthyValue$" ParameterType="int"/>

    <OverrideableParameter ID="AgeCriticalValue" Selector="$Config/AgeCriticalValue$" ParameterType="int"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="EventDS" TypeID="Microsoft.FEP.ProtectedServer.AntimalwareDefinitionsEventDSType"/>

      <ProbeAction ID="WMIProbe" TypeID="Microsoft.FEP.AntimalwareWMIProbeActionModuleType">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <DelayTime>$Config/DelayTime$</DelayTime>

        <MonitorName>Antimalware Definitions Date</MonitorName>

      </ProbeAction>

      <ConditionDetection ID="CriticalCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">-1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>GreaterEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeCriticalValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="HealthyCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">-1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>LessEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeHealthyValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="WarningCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">-1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>Greater</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeHealthyValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeCriticalValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="Healthy">

        <Node ID="HealthyCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Warning">

        <Node ID="WarningCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Critical">

        <Node ID="CriticalCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

    <OnDemandDetections>

      <OnDemandDetection MonitorTypeStateID="Healthy">

        <Node ID="HealthyCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Warning">

        <Node ID="WarningCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Critical">

        <Node ID="CriticalCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

    </OnDemandDetections>

  </MonitorImplementation>

</UnitMonitorType>