Microsoft Forefront Endpoint Protection 보안 취약성 정의 기간 모니터 유형

Microsoft.FEP.SecurityVulnerability.AntimalwareDefinitionsDate.MonitorType (UnitMonitorType)

Element properties:

Show References:
- Unit Monitors (1)

RunAs	Default
Accessibility	Public
Support Monitor Recalculate	True

Member Modules:

ID	Module Type	TypeId	RunAs
EventDS	DataSource	Microsoft.FEP.ProtectedServer.AntimalwareDefinitionsEventDSType	Default
WMIProbe	ProbeAction	Microsoft.FEP.AntimalwareWMIProbeActionModuleType	Default
CriticalCondition	ConditionDetection	System.ExpressionFilter	Default
HealthyCondition	ConditionDetection	System.ExpressionFilter	Default
WarningCondition	ConditionDetection	System.ExpressionFilter	Default

Overrideable Parameters:

ID	ParameterType	Selector	Display Name	Description
DelayTime	int	$Config/DelayTime$	지연 시간(초)
AgeHealthyValue	int	$Config/AgeHealthyValue$	정상 상태 정의 기간(일)	정의가 최신 상태를 유지하고 있는 기간(일)입니다. 지정한 기간(일)을 경과한 정의는 만료된 상태로 간주되며 경고 상태로 설정됩니다. 설정된 기간이 경과되면 경고가 생성됩니다. 매개 변수의 권장 값은 3일입니다.
AgeCriticalValue	int	$Config/AgeCriticalValue$	위험 상태 정의 기간(일)	최신 정의가 위험 상태로 설정되는 기간(일)입니다. 설정된 기간이 경과되면 경고가 생성됩니다. 매개 변수의 권장 값은 5일입니다.

Source Code:

<UnitMonitorType ID="Microsoft.FEP.SecurityVulnerability.AntimalwareDefinitionsDate.MonitorType" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="Healthy" NoDetection="false"/>

    <MonitorTypeState ID="Warning" NoDetection="false"/>

    <MonitorTypeState ID="Critical" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <xsd:element minOccurs="1" name="ComputerName" type="xsd:string"/>

    <xsd:element minOccurs="1" name="DelayTime" type="xsd:positiveInteger"/>

    <xsd:element minOccurs="1" name="AgeHealthyValue" type="xsd:positiveInteger"/>

    <xsd:element minOccurs="1" name="AgeCriticalValue" type="xsd:positiveInteger"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="DelayTime" Selector="$Config/DelayTime$" ParameterType="int"/>

    <OverrideableParameter ID="AgeHealthyValue" Selector="$Config/AgeHealthyValue$" ParameterType="int"/>

    <OverrideableParameter ID="AgeCriticalValue" Selector="$Config/AgeCriticalValue$" ParameterType="int"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="EventDS" TypeID="Microsoft.FEP.ProtectedServer.AntimalwareDefinitionsEventDSType"/>

      <ProbeAction ID="WMIProbe" TypeID="Microsoft.FEP.AntimalwareWMIProbeActionModuleType">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <DelayTime>$Config/DelayTime$</DelayTime>

        <MonitorName>Antimalware Definitions Date</MonitorName>

      </ProbeAction>

      <ConditionDetection ID="CriticalCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">-1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>GreaterEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeCriticalValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="HealthyCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">-1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>LessEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeHealthyValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="WarningCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="Integer">-1</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>Greater</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeHealthyValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Integer">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeCriticalValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="Healthy">

        <Node ID="HealthyCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Warning">

        <Node ID="WarningCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Critical">

        <Node ID="CriticalCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

    <OnDemandDetections>

      <OnDemandDetection MonitorTypeStateID="Healthy">

        <Node ID="HealthyCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Warning">

        <Node ID="WarningCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Critical">

        <Node ID="CriticalCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

    </OnDemandDetections>

  </MonitorImplementation>

</UnitMonitorType>