Defender is a Microsoft product that can be thought of as antivirus software. Any notifications of detecting, removing, and preventing detected malicious programs should be investigated. Even if a third-party antivirus or anti-spyware product is currently in use, the collection of Defender events may be useful in detecting anomalous system events. The following table lists the events in the Microsoft Windows/Windows Defender operational log:
Number of occurrences in rules | Eventid | Event source or category |
|---|---|---|
1 | 1005 | Microsoft-Windows-Windows Defender |
1 | 1006 | Microsoft-Windows-Windows Defender |
1 | 1008 | Microsoft-Windows-Windows Defender |
1 | 1010 | Microsoft-Windows-Windows Defender |
1 | 2001 | Microsoft-Windows-Windows Defender |
1 | 2003 | Microsoft-Windows-Windows Defender |
2 | 2004 | Microsoft-Windows-Windows Defender |
1 | 3002 | Microsoft-Windows-Windows Defender |
1 | 5008 | Microsoft-Windows-Windows Defender |