Windows Defender Definitions Monitor Type

Microsoft.WindowsDefender.SecurityVulnerability.AntimalwareDefinitions.MonitorType (UnitMonitorType)

Element properties:

Show References:
- Unit Monitors (1)

RunAs	Default
Accessibility	Public
Support Monitor Recalculate	True

Member Modules:

ID	Module Type	TypeId	RunAs
EventDS	DataSource	Microsoft.WindowsDefender.ProtectedServer.AntimalwareDefinitionsEventDSType	Default
WMIProbe	ProbeAction	Microsoft.WindowsDefender.AntimalwareWMIProbeActionModuleType	Default
CriticalCondition	ConditionDetection	System.ExpressionFilter	Default
HealthyCondition	ConditionDetection	System.ExpressionFilter	Default
WarningCondition	ConditionDetection	System.ExpressionFilter	Default

Overrideable Parameters:

ID	ParameterType	Selector	Display Name	Description
DelayTime	int	$Config/DelayTime$	Delay Time (Seconds)
AgeHealthyValue	int	$Config/AgeHealthyValue$	Healthy State Definitions Age (Days)	The number of days that definitions are considered to be current. Definitions older than the specified number of days are considered to be out of date and in a Warning state. An alert will be generated. The recommended value for this parameter is three days.
AgeCriticalValue	int	$Config/AgeCriticalValue$	Critical State Definitions Age (Days)	The number of days at which out-of-date definitions are considered to be in a Critical state. An alert will be generated. The recommended value for this parameter is five days.

Source Code:

<UnitMonitorType ID="Microsoft.WindowsDefender.SecurityVulnerability.AntimalwareDefinitions.MonitorType" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="Healthy" NoDetection="false"/>

    <MonitorTypeState ID="Warning" NoDetection="false"/>

    <MonitorTypeState ID="Critical" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="ComputerName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="DelayTime" type="xsd:positiveInteger"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="AgeHealthyValue" type="xsd:positiveInteger"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" minOccurs="1" name="AgeCriticalValue" type="xsd:positiveInteger"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="DelayTime" Selector="$Config/DelayTime$" ParameterType="int"/>

    <OverrideableParameter ID="AgeHealthyValue" Selector="$Config/AgeHealthyValue$" ParameterType="int"/>

    <OverrideableParameter ID="AgeCriticalValue" Selector="$Config/AgeCriticalValue$" ParameterType="int"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="EventDS" TypeID="Microsoft.WindowsDefender.ProtectedServer.AntimalwareDefinitionsEventDSType"/>

      <ProbeAction ID="WMIProbe" TypeID="Microsoft.WindowsDefender.AntimalwareWMIProbeActionModuleType">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <DelayTime>$Config/DelayTime$</DelayTime>

        <MonitorName>Antimalware Definitions Date</MonitorName>

      </ProbeAction>

      <ConditionDetection ID="CriticalCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">Property[@Name='AntivirusSignatureAge']</XPathQuery>

            </ValueExpression>

            <Operator>GreaterEqual</Operator>

            <ValueExpression>

              <Value Type="Integer">$Config/AgeCriticalValue$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="HealthyCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">Property[@Name='AntivirusSignatureAge']</XPathQuery>

            </ValueExpression>

            <Operator>LessEqual</Operator>

            <ValueExpression>

              <Value Type="Integer">$Config/AgeHealthyValue$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

      <ConditionDetection ID="WarningCondition" TypeID="System!System.ExpressionFilter">

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>Greater</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeHealthyValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">Property[@Name='AntivirusSignatureAge']</XPathQuery>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Integer">$Config/AgeCriticalValue$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="Healthy">

        <Node ID="HealthyCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Warning">

        <Node ID="WarningCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="Critical">

        <Node ID="CriticalCondition">

          <Node ID="WMIProbe">

            <Node ID="EventDS"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

    <OnDemandDetections>

      <OnDemandDetection MonitorTypeStateID="Healthy">

        <Node ID="HealthyCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Warning">

        <Node ID="WarningCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

      <OnDemandDetection MonitorTypeStateID="Critical">

        <Node ID="CriticalCondition">

          <Node ID="WMIProbe"/>

        </Node>

      </OnDemandDetection>

    </OnDemandDetections>

  </MonitorImplementation>

</UnitMonitorType>