Event ID 1009 — ProductName has restored an item from quarantine.

Description

ProductName has restored an item from quarantine.

Message #

%1 has restored an item from quarantine.
 For more information please see the following:
%15
 	Name: %11
 	ID: %12
 	Severity: %25
 	Category: %26
 	User: %8\%9
 	Security intelligence Version: %27
 	Engine Version: %28

Fields #

References #

• RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/