windows defender
March 22, 2023 · View on GitHub
Expression
product = "windows defender"
Fields
There are no fields for this extension.
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| alert-trigger | app | ||||
| file_path | Legacy | ✓ | |||
| file_name | Legacy | ✓ | |||
| message_id | |||||
| recipient_count | |||||
| target | |||||
| result | |||||
| additional_info | |||||
| user_id | |||||
| recipients | |||||
| account_name | |||||
| alert_id | Legacy | ✓ | |||
| recipient | |||||
| email_domain | |||||
| event_name | |||||
| user | Legacy | ✓ | |||
| object |