ThreatStatusDetails: A longer description.

ThreatStatus: A description for the above code.ThreatStatusRank: A code indicating the health of the device according to defender:.In there, you’ll find some columns such as: Approximately every hour, a record is stored in this table for every VM running Windows Defender. I recently found out that a table in Log Analytics called ProtectionStatus contains a “heartbeat” record for Windows Defender. We use a single Log Analytics workspace to enable the correlation of data and easy reporting/management. We also enable data collection in Azure Security Center. DataĪt work, we always deploy the Log Analytics extension with all VMs – along with the antimalware extension and a bunch of others. So I needed something different to operationalise Windows Defender with Azure VMs. There is a Log Analytics solution, but solutions are deprecated and, last time I checked, it required the workspace to be in per-node pricing mode. But the level of management is poor-none. There is an integration with the control plane using the antimalwareagent extension. But it surprises me how many of my customers (all) choose Defender over third-parties for their Azure VMs … with no coaching/encouragement from me or my colleagues. Windows Defender is built into Windows Server 2016 and Windows Server 2019. In this post, I will explain how one can monitor Windows Defender and create incidents for it with Azure VMs.

Antimalware for azure