| DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
| Periodic evaluation of active malware health | | Microsoft.FEP.ActiveMalwareMonitorFallbackTriggerRule | Microsoft.FEP.ProtectedServer | SecurityHealth | True | | | 0 | 0 | | False | | | True | |
| Client Pending Restart | This rule detects whether an endpoint requires a restart in order to complete the FEP client installation. | Microsoft.FEP.AlertForDeploymentPendingRebootAlertRule | Microsoft.FEP.ProtectedServerCandidate | Custom | True | | | 0 | 0 | | True | Information | Low | True | |
| Repeated Malware Infection Rule | This alert detects repeated occurrences of a malware infection on a single computer. | Microsoft.FEP.AlertForRepeatedInfectionRule | Microsoft.FEP.ProtectedServer | SecurityHealth | True | | | 0 | 0 | | True | Error | High | True | |
| Collect Security Events Rule | | Microsoft.FEP.CollectSecurityEventsRule | Microsoft.FEP.ProtectedServer | EventCollection | True | | | 0 | 0 | | False | | | True | |
| Periodic evaluation of deployment failure health | | Microsoft.FEP.DeploymentFailureFallbackTriggerRule | Microsoft.FEP.ProtectedServerCandidate | SecurityHealth | True | | | 0 | 0 | | False | | | True | |
| Malware Cleaned Alert Rule | Generates an alert when Microsoft Forefront Endpoint Protection client has reported on a cleaned malware. | Microsoft.FEP.MalwareCleanedAlertRule | Microsoft.FEP.ProtectedServer | Custom | True | | | 0 | 0 | | True | Information | Low | True | |