Art der Echtzeitschutzüberwachung von Microsoft Forefront Endpoint Protection Security
Microsoft.FEP.SecurityVulnerability.RTPMonitorType (UnitMonitorType)
Element properties:
Member Modules:
Overrideable Parameters:
Source Code:
<UnitMonitorType ID="Microsoft.FEP.SecurityVulnerability.RTPMonitorType" Accessibility="Public">
<MonitorTypeStates>
<MonitorTypeState ID="On" NoDetection="false"/>
<MonitorTypeState ID="Off" NoDetection="false"/>
</MonitorTypeStates>
<Configuration>
<xsd:element minOccurs="1" name="ComputerName" type="xsd:string"/>
<xsd:element minOccurs="1" name="DelayTime" type="xsd:positiveInteger"/>
</Configuration>
<OverrideableParameters>
<OverrideableParameter ID="DelayTime" Selector="$Config/DelayTime$" ParameterType="int"/>
</OverrideableParameters>
<MonitorImplementation>
<MemberModules>
<DataSource ID="EventDS" TypeID="Microsoft.FEP.ProtectedServer.RTPEventDSType"/>
<ProbeAction ID="WMIProbe" TypeID="Microsoft.FEP.AntimalwareWMIProbeActionModuleType">
<ComputerName>$Config/ComputerName$</ComputerName>
<DelayTime>$Config/DelayTime$</DelayTime>
<MonitorName>Real-time Protection</MonitorName>
</ProbeAction>
<ConditionDetection ID="RTPOnCondition" TypeID="System!System.ExpressionFilter">
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Boolean">Property[@Name='RtpEnabled']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="Boolean">true</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Boolean">Property[@Name='OnAccessProtectionEnabled']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="Boolean">true</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</ConditionDetection>
<ConditionDetection ID="RTPOffCondition" TypeID="System!System.ExpressionFilter">
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Boolean">Property[@Name='RtpEnabled']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="Boolean">false</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Boolean">Property[@Name='OnAccessProtectionEnabled']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="Boolean">false</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</ConditionDetection>
</MemberModules>
<RegularDetections>
<RegularDetection MonitorTypeStateID="On">
<Node ID="RTPOnCondition">
<Node ID="WMIProbe">
<Node ID="EventDS"/>
</Node>
</Node>
</RegularDetection>
<RegularDetection MonitorTypeStateID="Off">
<Node ID="RTPOffCondition">
<Node ID="WMIProbe">
<Node ID="EventDS"/>
</Node>
</Node>
</RegularDetection>
</RegularDetections>
<OnDemandDetections>
<OnDemandDetection MonitorTypeStateID="On">
<Node ID="RTPOnCondition">
<Node ID="WMIProbe"/>
</Node>
</OnDemandDetection>
<OnDemandDetection MonitorTypeStateID="Off">
<Node ID="RTPOffCondition">
<Node ID="WMIProbe"/>
</Node>
</OnDemandDetection>
</OnDemandDetections>
</MonitorImplementation>
</UnitMonitorType>