Windows Defender Antivirus

[jamiehynds]

Description

Microsoft Defender Antivirus, formerly known as Windows Defender, is an antivirus program bundled with Windows 10. Microsoft Defender Antivirus has many features, including substantial security settings for individual users and groups.

Architecture

Similar to PowerShell events, Windows Defender writes events to a Windows Event channel - Windows Defender/Operational. While users can leverage our Custom Windows Event integration to ingest these events, ECS mappings are not applied.

Integration release checklist

This checklist is intended for integrations maintainers to ensure consistency
when creating or updating a Package, Module or Dataset for an Integration.

All changes

• Change follows the contributing guidelines
• Supported versions of the monitoring target are documented
• Supported operating systems are documented (if applicable)
• Integration or System tests exist
• Documentation exists
• Fields follow ECS and naming conventions
• At least a manual test with ES / Kibana / Agent has been performed.
• Required Kibana version set to:

New Package

• Screenshot of the "Add Integration" page on Fleet added

Dashboards changes

• Dashboards exists
• Screenshots added or updated
• Datastream filters added to visualizations

Log dataset changes

• Pipeline tests exist (if applicable)
• Generated output for at least 1 log file exists
• Sample event (sample_event.json) exists

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[infosecwatchman]

+1

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[nicpenning]

This integration will still be relevant and useful today. This will also help with: #4564

[nicpenning]

Phase 1 complete with initial data stream created as beta.
Phase 2 will be improved alignment with ECS, Dashboard, and any bug fixes along the way to solidify it as GA.