Monitoring Windows Defender Malware Detections

joseph.foran

We have a few remote workers who use their own devices at home (because all of our corporate resources are cloud-hosted and don't really interact with the operating system) but we need to provide help and support for printers and such - and we monitor their system security. We use this nice little custom alert to monitor Windows Defender detections and so far it's proven remarkably effective:

*For those wanting to copy paste it's Microsoft-Windows-Windows Defender/Operational for the Custom Folder and 1006,1007,1013,1015,1116,1117,1118 for the event IDs