microsoft windows defender

Expression

product = "microsoft windows defender"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	file_path	Legacy			✓
	file_name	Legacy	✓
	message_id
	recipient_count
	domain_user_name
	target
	result
	additional_info
	sender	Legacy	✓
	user_id
	bytes	Legacy		✓
	recipients
	alert_id	Legacy			✓
	domain
	recipient
	event_name
	operation
	email_subject
	user	Legacy		✓
	apps
	object
process-memory-protect	additional_info
	action				✓
	event_name				✓
	operation				✓