Microsoft-Antimalware-Service
124 events across 1 channel
Event ID 1 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 2 —
Event ID 4 —
Event ID 5 —
Event ID 6 —
Event ID 7 —
Event ID 8 —
Event ID 9 —
Event ID 10 —
Event ID 11 —
Event ID 12 —
Event ID 13 —
Event ID 14 —
Event ID 15 —
Event ID 16 —
Event ID 17 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 18 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 19 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 20 —
Fields
| Name | Description |
|---|---|
File_ID | — |
USN | — |
Event ID 21 —
Fields
| Name | Description |
|---|---|
File_ID | — |
USN | — |
Event ID 22 —
Fields
| Name | Description |
|---|---|
File_ID | — |
USN | — |
Event ID 23 —
Fields
| Name | Description |
|---|---|
File_ID | — |
USN | — |
Event ID 24 —
Event ID 25 —
Event ID 26 —
Event ID 27 —
Event ID 28 —
Fields
| Name | Description |
|---|---|
ServiceVersion | — |
OsIsFreshInstall | — |
Event ID 29 —
Event ID 30 —
Event ID 31 —
Fields
| Name | Description |
|---|---|
TrustedUSN | — |
TrustedState | — |
SFCState | — |
Event ID 32 —
Event ID 33 —
Event ID 34 —
Event ID 35 —
Event ID 36 —
Event ID 37 —
Event ID 38 —
Event ID 39 —
Fields
| Name | Description |
|---|---|
Bytes | — |
Event ID 40 —
Event ID 41 —
Event ID 42 —
Event ID 43 —
Event ID 44 —
Fields
| Name | Description |
|---|---|
Command | — |
Event ID 45 —
Event ID 46 —
Event ID 47 —
Event ID 48 —
Fields
| Name | Description |
|---|---|
Sha1 | — |
Sha256 | — |
MD5 | — |
ProcessID | — |
ProcessCreationTime | — |
ProcessPath | — |
ThreatName | — |
RealPath | — |
WasExecutingWhileDetected | — |
Action | — |
RemediationErrorCode | — |
DetectionTime | — |
User | — |
UserSid | — |
ResourceSchema | — |
DetectionGuid | — |
Classification | — |
SchemaParamAndDataDelimiter | — |
SchemaParamList | — |
SchemaParamDataList | — |
DetectionSource | — |
IsPassiveMode | — |
SigSeq | — |
SigSha | — |
isCritical | — |
ThreatTrackingId | — |
PlatformVersion | — |
PlatformUpdateTime | — |
EngineVersion | — |
EngineUpdateTime | — |
ASSignatureVersion | — |
ASSignatureUpdateTime | — |
AVSignatureVersion | — |
AVSignatureUpdateTime | — |
BlockThreatExecSubCategory | — |
PropertyBag | — |
AllowThreatExpirationUTC | — |
Event ID 49 —
Fields
| Name | Description |
|---|---|
RuleId | — |
isAudit | — |
Sha1 | — |
Sha256 | — |
MD5 | — |
FileSize | — |
ProcessID | — |
ProcessCreationTime | — |
ProcessIntegrityLevel | — |
ProcessPath | — |
TargetPath | — |
SigSeq | — |
SigSha | — |
CommandLine | — |
DetectionTime | — |
TargetIdentified | — |
ParentCommandLine | — |
InvolvedFile | — |
InheritanceFlags | — |
RuleType | — |
RuleState | — |
SessionId | — |
UserName | — |
Event ID 50 —
Fields
| Name | Description |
|---|---|
IsAudit | — |
Uri | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ResponseCategory | — |
IsWarn | — |
DisplayName | — |
IocId | — |
Event ID 51 —
Fields
| Name | Description |
|---|---|
LocalIpAddressLength | — |
LocalIpAddress | — |
RemoteIpAddressLength | — |
RemoteIpAddress | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ProcessName | — |
Uri | — |
RequestHeaders | — |
ResponseHeaders | — |
ConnectionType | — |
Event ID 52 —
Fields
| Name | Description |
|---|---|
RuleId | — |
State | — |
EventTimestamp | — |
Action | — |
Process | — |
ProcessId | — |
Source | — |
Target | — |
SessionId | — |
Event ID 53 —
Fields
| Name | Description |
|---|---|
UniqueId | — |
TotalSourceFiles | — |
CurrentIndexOfSourceFile | — |
PolicyVersion | — |
PolicyRuleId | — |
EnforcementLevel | — |
IsActionBypass | — |
EventTimestamp | — |
ActionType | — |
Process | — |
ProcessId | — |
ProcessCreationTime | — |
Source | — |
Target | — |
SessionId | — |
UserSid | — |
Event ID 54 —
Fields
| Name | Description |
|---|---|
StatusCode | — |
StatusDetails | — |
Event ID 55 —
Fields
| Name | Description |
|---|---|
Allow | — |
UserOverrideKey | — |
FriendlyName | — |
Uri | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ResponseCategory | — |
IocId | — |
Event ID 56 —
Fields
| Name | Description |
|---|---|
RuleId | — |
RuleState | — |
SessionId | — |
TargetIdentified | — |
Parent | — |
Target | — |
InvolvedFile | — |
ProcessId | — |
ProcessCreationTime | — |
Event ID 57 —
Fields
| Name | Description |
|---|---|
DnsServerAddressLength | — |
DnsServerIpAddress | — |
QueryName | — |
QueryType | — |
ClassType | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ProcessName | — |
Event ID 58 —
Fields
| Name | Description |
|---|---|
DnsServerAddressLength | — |
DnsServerIpAddress | — |
AnswerName | — |
Ttl | — |
RecordType | — |
ResourceRecord | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ProcessName | — |
Event ID 59 —
Fields
| Name | Description |
|---|---|
IsIncoming | — |
SourceIpLength | — |
SourceIp | — |
DestinationIpLength | — |
DestinationIp | — |
Size | — |
DestinationDNSName | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ProcessName | — |
ConnectionType | — |
IsBehindProxy | — |
Event ID 60 —
Fields
| Name | Description |
|---|---|
TS_State | — |
TS_PreviousState | — |
TS_StartUTC | — |
TS_ExpirationUTC | — |
TS_ExpirationMinutesLeft | — |
TS_StateChangeSource | — |
TS_StateChangeReason | — |
TS_QuotaMinutesLeft | — |
PlatformVersion | — |
EngineVersion | — |
Event ID 61 —
Fields
| Name | Description |
|---|---|
TlsServerAddressLength | — |
TlsServerIpAddress | — |
TlsAlertLevel | — |
TlsAlertDescription | — |
ProcessId | — |
ProcessCreationTime | — |
UserSid | — |
ProcessName | — |
Event ID 62 —
Fields
| Name | Description |
|---|---|
Timestamp | — |
RollbackVersion | — |
Event ID 63 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 64 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 65 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 66 —
Fields
| Name | Description |
|---|---|
Description | — |
Event ID 67 —
Fields
| Name | Description |
|---|---|
DetectionTime | — |
TP_State | — |
TP_Scenario | — |
TP_ResourceType | — |
TP_ResourceName | — |
TP_ResourceOldState | — |
TP_ResourceNewState | — |
TP_IsBlocked | — |
TP_IsUserMode | — |
ProcessName | — |
ProcessId | — |
ProcessCreationTime | — |
Event ID 68 —
Fields
| Name | Description |
|---|---|
FullPath | — |
Version | — |
FileSize | — |
FrameworkType | — |
Sha256 | — |
JsonModelMetadata | — |
Event ID 69 —
Fields
| Name | Description |
|---|---|
Version | — |
TransportType | — |
ServerName | — |
CommandName | — |
CommandArgs | — |
UrlEndpoint | — |
Environment | — |
Headers | — |
Event ID 70 —
Fields
| Name | Description |
|---|---|
ProcessName | — |
ProcessId | — |
ProcessCreationTime | — |
RegKeyName | — |
RegValueName | — |
DisruptionMode | — |
Event ID 1000 — An antimalware scan started.
Fields
| Name | Description |
|---|---|
Scan ID | ID number of the relevant scan. |
Scan Type | Scan type. Examples: Antivirus, Antispyware, or Antimalware |
Scan Parameters | Scan parameters. Examples: Full scan, Quick scan, or Custom scan |
Scan Resources | Resources (such as files/directories/BHO) that were scanned. |
User | Domain\User |
Event ID 1001 — An antimalware scan finished.
Fields
| Name | Description |
|---|---|
Scan ID | ID number of the relevant scan. |
Scan Type | Scan type. Examples: Antivirus, Antispyware, or Antimalware |
Scan Parameters | Scan parameters. Examples: Full scan, Quick scan, or Custom scan |
User | Domain\User |
Scan Time | The duration of a scan. |
Event ID 1002 — An antimalware scan was stopped before it finished.
Fields
| Name | Description |
|---|---|
Scan ID | ID number of the relevant scan. |
Scan Type | Scan type. Examples: Antivirus, Antispyware, or Antimalware |
Scan Parameters | Scan parameters. Examples: Full scan, Quick scan, or Custom scan |
User | Domain\User |
Scan Time | The duration of a scan. |
Event ID 1006 — The antimalware engine found malware or other potentially unwanted software.
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description. Examples: Any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This source includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC. |
Status | — |
User | Domain\User |
Process Name | Process name (identified by PID) |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1007 — The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
Message
Fields
| Name | Description |
|---|---|
User | Domain\User |
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Status | — |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1008 — The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
Message
Fields
| Name | Description |
|---|---|
User | Domain\User |
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Status | — |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1009 — The antimalware platform restored an item from quarantine.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1010 — The antimalware platform couldn't restore an item from quarantine.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1011 — The antimalware platform deleted an item from quarantine.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1012 — The antimalware platform couldn't delete an item from quarantine.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1013 — The antimalware platform deleted history of malware and other potentially unwanted software.
Message
Fields
| Name | Description |
|---|---|
Time | The time when the event occurred, for example when the history is purged. This parameter isn't used in threat events so that there's no confusion regarding whether it's remediation time or infection time. For such events, we specifically call them as Action Time or Detection Time. |
User | Domain\User |
Event ID 1014 — The antimalware platform couldn't delete history of malware and other potentially unwanted software.
Message
Fields
| Name | Description |
|---|---|
Time | The time when the event occurred, for example when the history is purged. This parameter isn't used in threat events so that there's no confusion regarding whether it's remediation time or infection time. For such events, we specifically call them as Action Time or Detection Time. |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 1015 — The antimalware platform detected suspicious behavior.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this source protects against malicious webpage controls. Early Launch Antimalware (ELAM). This source includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
Status | — |
User | Domain\User |
Process Name | Process name (identified by PID) |
Signature ID | Enumeration matching severity. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Fidelity Label | — |
Target File Name | Name of the file. |
Event ID 1116 — The antimalware platform detected malware or other potentially unwanted software.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1117 — The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this source protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Action Status | Description of other actions |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1118 — The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence. Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Action | Action. Examples: Clean: The resource was cleaned. Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing |
Action Status | Description of additional actions |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1119 — The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software.
Message
Fields
| Name | Description |
|---|---|
Name | Threat name |
ID | Threat ID |
Severity | Severity. Examples: Low, Moderate, High, or Severe |
Category | Category description, for example, any threat or malware type. |
Path | File path |
Detection Origin | Detection origin. Examples: Unknown, Local computer, Network share, Internet, Incoming traffic, or Outgoing traffic |
Detection Type | Detection type. Examples: Heuristics, Generic, Concrete, or Dynamic signature |
Detection Source | Detection source for example: User: user initiated System: system initiated Real-time: real-time component initiated IOAV: IE Downloads and Outlook Express Attachments initiated NIS: Network inspection system IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls. Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence Remote attestation Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PowerShell, VBS), though it can be invoked by third parties as well. UAC |
User | Domain\User |
Process Name | Process name (identified by PID) |
Action | Action. Examples: Clean: The resource was cleaned Quarantine: The resource was quarantined. Remove: The resource was deleted. Allow: The resource was allowed to execute/exist. User defined: User-defined action that's typically from this list of actions specified by the user. No action: No action Block: The resource was blocked from executing. |
Action Status | Description of other actions |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1120 — Microsoft Defender Antivirus deduced the hashes for a threat resource.
Fields
| Name | Description |
|---|---|
Current Platform Version | — |
Threat Resource Path | Path |
Hashes | — |
Event ID 1121 — Event when an attack surface reduction rule fires in block mode.
Event ID 1127 — Controlled Folder Access (CFA) blocked an untrusted process from making changes to the memory.
Message
Fields
| Name | Description |
|---|---|
Product Name | Product Name. Examples: Microsoft Defender Antivirus |
Product Version | — |
Detection Time | Detection Time, time when CFA blocked an untrusted process |
User | Domain\User |
Path | Device name, name of the device or disk that an untrusted process accessed for modification |
Process Name | Process path, the process path name that CFA blocked from accessing the device or disk for modification |
Security Intelligence Version | — |
Engine Version | Antimalware Engine version |
Event ID 1150 — Antimalware platform health status report.
Message
Fields
| Name | Description |
|---|---|
Platform Version | Current platform version |
Signature Version | Definition version |
Engine Version | Antimalware Engine version |
Event ID 1151 — Endpoint Protection client health report (time in UTC)
Message
Fields
| Name | Description |
|---|---|
Platform Version | Current platform version |
Engine Version | Antimalware Engine version |
Network Realtime Inspection engine version | — |
Antivirus signature version | — |
Antispyware signature version | — |
Network Realtime Inspection signature version | — |
RTP state | Realtime protection state (Enabled or Disabled) |
OA state | On Access state (Enabled or Disabled) |
IOAV state | IE Downloads and Outlook Express Attachments state (Enabled or Disabled) |
BM state | Behavior Monitoring state (Enabled or Disabled) |
Antivirus signature age | Antivirus signature age (in days). Calculated as the time starting from the Security Intelligence Update (SIU) release date, to the current date. Before a signature is updated for the first time, it'll display an age of 65535 days. |
Antispyware signature age | Antispyware signature age (in days). Timestamp reflecting the Security Intelligence Update (SIU) release date (not the local installation time). Before the timestamp is updated for the first time, its value is null. |
Last quick scan age | Last quick scan age (in days) |
Last full scan age | Last full scan age (in days) |
Antivirus signature creation time | — |
Antispyware signature creation time | — |
Last quick scan start time | — |
Last quick scan end time | — |
Last quick scan source | Last quick scan source (0 = scan didn't run, 1 = user initiated, 2 = system initiated) |
Last full scan start time | — |
Last full scan end time | — |
Last full scan source | Last full scan source (0 = scan didn't run, 1 = user initiated, 2 = system initiated) |
Product status | For internal troubleshooting |
Event ID 2000 — The antimalware definitions updated successfully.
Message
Fields
| Name | Description |
|---|---|
Current Signature Version | — |
Previous Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Update Type | Update type, either Full or Delta. |
User | Domain\User |
Current Engine Version | — |
Previous Engine Version | — |
Event ID 2001 — The security intelligence update failed.
Message
Fields
| Name | Description |
|---|---|
New security intelligence version | New version number |
Previous security intelligence version | Previous version |
Update Source | Update source. Examples: Security intelligence update folder Internal security intelligence update server Microsoft Update Server File share Microsoft Malware Protection Center (MMPC) |
Update Stage | Update stage. Examples: Search, Download, or Install |
Source Path | File share name for Universal Naming Convention (UNC), server name for Windows Server Update Services (WSUS)/Microsoft Update/ADL. |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Update Type | Update type, either Full or Delta. |
User | Domain\User |
Current Engine Version | — |
Previous Engine Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2002 — The antimalware engine updated successfully.
Message
Fields
| Name | Description |
|---|---|
Current Engine Version | — |
Previous Engine Version | — |
Engine Type | Engine type, either antimalware engine or Network Inspection System engine. |
User | Domain\User |
Event ID 2003 — The antimalware engine update failed.
Message
Fields
| Name | Description |
|---|---|
New Engine Version | — |
Previous Engine Version | — |
Engine Type | Engine type, either antimalware engine or Network Inspection System engine. |
User | Domain\User |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2004 — There was a problem loading antimalware definition.
Message
Fields
| Name | Description |
|---|---|
Signatures Attempted | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Signature Version | Definition version |
Engine Version | Antimalware engine version |
Event ID 2005 — The antimalware engine failed to load because the antimalware platform is out of date.
Message
Fields
| Name | Description |
|---|---|
Current Platform Version | — |
Event ID 2006 — The platform update failed.
Message
Fields
| Name | Description |
|---|---|
Current Platform Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2007 — The platform will soon be out of date.
Message
Fields
| Name | Description |
|---|---|
Current Platform Version | — |
Event ID 2010 — The antimalware engine used the Dynamic Signature Service to get other definitions.
Message
Fields
| Name | Description |
|---|---|
Current Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Current Engine Version | — |
Dynamic Signature Type | Dynamic signature type. Examples: Version, Timestamp, No limit, or Duration |
Persistence Path | Path |
Dynamic Signature Version | Version number |
Dynamic Signature Compilation Timestamp | Timestamp |
Persistence Limit Type | Persistence limit type. Examples: VDM version, Timestamp, or No limit |
Persistence Limit | Persistence limit of the fastpath signature. |
Event ID 2011 — The Dynamic Signature Service deleted the out-of-date dynamic definitions.
Message
Fields
| Name | Description |
|---|---|
Current Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Current Engine Version | — |
Dynamic Signature Type | Dynamic signature type. Examples: Version, Timestamp, No limit, or Duration |
Persistence Path | Path |
Dynamic Signature Version | Version number |
Dynamic Signature Compilation Timestamp | Timestamp |
Removal Reason | — |
Persistence Limit Type | Persistence limit type. Examples: VDM version, Timestamp, or No limit |
Persistence Limit | Persistence limit of the fastpath signature. |
Event ID 2012 — The antimalware engine encountered an error when trying to use the Dynamic Signature Service.
Message
Fields
| Name | Description |
|---|---|
Current Signature Version | — |
Signature Type | Signature type. Examples: Antivirus, Antispyware, Antimalware, or Network Inspection System |
Current Engine Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Dynamic Signature Type | Dynamic signature type. Examples: Version, Timestamp, No limit, or Duration |
Persistence Path | Path |
Dynamic Signature Version | Version number |
Dynamic Signature Compilation Timestamp | Timestamp |
Persistence Limit Type | Persistence limit type. Examples: VDM version, Timestamp, or No limit |
Persistence Limit | Persistence limit of the fastpath signature. |
Event ID 2013 — The Dynamic Signature Service deleted all dynamic definitions.
Message
Fields
| Name | Description |
|---|---|
Current Signature Version | — |
Event ID 2020 — The antimalware engine downloaded a clean file.
Message
Fields
| Name | Description |
|---|---|
Filename | Name of the file. |
Current Signature Version | — |
Current Engine Version | — |
Event ID 2021 — The antimalware engine failed to download a clean file.
Message
Fields
| Name | Description |
|---|---|
Filename | Name of the file. |
Current Signature Version | — |
Current Engine Version | — |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2030 — The antimalware engine was downloaded and is configured to run offline on the next system restart.
Message
Event ID 2031 — The antimalware engine was unable to download and configure an offline scan.
Message
Fields
| Name | Description |
|---|---|
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Event ID 2040 — Antimalware support for this operating system version will soon end.
Message
Event ID 2041 — Antimalware support for this operating system has ended.
Message
Event ID 2042 — The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware.
Message
Event ID 3002 — Real-time protection encountered an error and failed.
Message
Fields
| Name | Description |
|---|---|
Feature | Feature. Examples: On Access, Internet Explorer downloads and Microsoft Outlook Express attachments, Behavior monitoring, or Network Inspection System. |
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |
Reason | The reason Microsoft Defender Antivirus real-time protection restarted a feature. |
Event ID 3007 — Real-time protection recovered from a failure.
Message
Fields
| Name | Description |
|---|---|
Feature | Feature. Examples: On Access, IE downloads and Outlook Express attachments, Behavior monitoring, or Network Inspection System |
Reason | The reason Microsoft Defender Antivirus real-time protection restarted a feature. |
Event ID 5000 — Real-time protection is enabled.
Message
Event ID 5001 — Real-time protection is disabled.
Message
Event ID 5004 — The real-time protection configuration changed.
Message
Fields
| Name | Description |
|---|---|
Feature | Feature. Examples: On Access, IE downloads and Outlook Express attachments, Behavior monitoring, or Network Inspection System |
Event ID 5007 — The antimalware platform configuration changed.
Message
Fields
| Name | Description |
|---|---|
Old value | Old antivirus configuration value. |
New value | New antivirus configuration value. |
Event ID 5008 — The antimalware engine encountered an error and failed.
Message
Fields
| Name | Description |
|---|---|
Failure Type | Failure type. Examples: Crash or Hang |
Exception Code | Error code |
Resource | — |
Event ID 5009 — Scanning for malware and other potentially unwanted software is enabled.
Message
Event ID 5010 — Scanning for malware and other potentially unwanted software is disabled.
Message
Event ID 5011 — Scanning for viruses is enabled.
Message
Event ID 5012 — Scanning for viruses is disabled.
Message
Event ID 5013 — Tamper protection blocked a change to Microsoft Defender Antivirus.
Message
Event ID 5100 — The antimalware platform expires soon.
Message
Fields
| Name | Description |
|---|---|
Expiration Reason | The reason Microsoft Defender Antivirus expires. |
Expiration Date | The date Microsoft Defender Antivirus expires. |
Event ID 5101 — The antimalware platform is expired.
Message
Fields
| Name | Description |
|---|---|
Error Code | Result code associated with threat status. Standard HRESULT values. |
Error Description | Description of the error. |