Catch All (Windows Defender)

Vendor Documentation

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus

Classification

Rule Name	Rule Type	Classification	Common Event
Catch All	Base Rule	Operations : Information	General Information Log Message
EVID 1150 : Service in Healthy State	Sub rule	Operations : Information	General Health Monitor Information
EVID 1151 : Service Health Report	Sub rule	Operations : Information	General Health Monitor Information
EVID 2000 : Malware Signatures Updated	Sub rule	Operations : Information	Update Successful
EVID 2001 : Malware Signature Update Failed	Sub rule	Operations : Error	Update Failed
EVID 2002 : Malware Engine Updated	Sub rule	Operations : Information	Update Successful
EVID 2003 : Malware Engine Update Failed	Sub rule	Operations : Error	Update Failed
EVID 2004 : Malware Signature Reverted	Sub rule	Operations : Information	General System Information
EVID 2005 : Malware Platform Out of Date	Sub rule	Operations : Warning	General System Warning
EVID 2006 : Malware Platform Update Failed	Sub rule	Operations : Error	Update Failed
EVID 2007 : Malware Platform Soon to be Out of Date	Sub rule	Operations : Warning	General System Warning
EVID 2010 : Malware Signatures Updated	Sub rule	Operations : Information	Update Successful
EVID 2011 : Obsolete Malware Signatures Deleted	Sub rule	Operations : Information	General System Information
EVID 2012 : Malware Signature Update Failed	Sub rule	Operations : Error	Update Failed
EVID 2013 : Dynamic Malware Signatures Deleted	Sub rule	Operations : Information	General System Information
EVID 2020 : Malware Engine Downloaded Clean File	Sub rule	Operations : Information	Update Successful
EVID 2021 : Malware Engine Failed to Download Clean File	Sub rule	Operations : Error	Update Failed
EVID 2030 : Offline Scan Installed	Sub rule	Operations : Information	Install Successful
EVID 2031 : Offline Scan Installation Failed	Sub rule	Operations : Warning	Software Installation Failed
EVID 2040 : Support for OS Expiring	Sub rule	Operations : Warning	General System Warning
EVID 2041 : Support for OS Ended	Sub rule	Operations : Critical	General System Critical
EVID 2042 : Support for OS Ended	Sub rule	Operations : Critical	General System Critical
EVID 5100 : Malware Platform Expiring Soon	Sub rule	Operation : Warning	License Period Will Expire Soon
EVID 5101 : Malware Platform Expired	Sub rule	Operations : Critical	License expired
EVID 5007 : Malware Platform Configuration Modified	Sub rule	Audit : Configuration	Configuration Modified : Security
EVID 5008 : Malware Engine Encountered Error	Sub rule	Operations : Error	General Windefend Error
EVID 5009 : Malware Scanning Enabled	Sub rule	Audit : Configuration	Configuration Enabled : Security
EVID 5010 : Malware Scanning Disabled	Sub rule	Audit : Configuration	Configuration Disabled : Security
EVID 5011 : Virus Scan Enabled	Sub rule	Audit : Configuration	Configuration Enabled : Security
EVID 5012 : Virus Scan Disabled	Sub rule	Audit : Configuration	Configuration Disabled : Security

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Provider			Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID	<vmid> <tag1>	Number	The identifier that the provider used to identify the event.
Version			The version number of the event's definition.
Level	<severity>	String/Number	The severity level defined in the event.
Task			The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Opcode			The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Keywords			A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreated			The time stamp that identifies when the event was logged. The time stamp includes either the SystemTime attribute or the RawTime attribute.
EventRecordID			The record number assigned to the event when it was logged.
Correlation			The activity identifiers that consumers can use to group related events together.
Execution			Contains information about the process and thread that logged the event.
Channel			The channel to which the event was logged.
Computer	<dname>	Text/String	The name of the computer on which the event occurred.
Security
			A description of the event.
Current Signature Version
Previous Signature Version
Signature Type
Update Type
User
Current Engine Version
Previous Engine Version