detection.wiki

Microsoft.Windows.Defender

TitleSampleRule
Platform.GenericCountYN
Engine.Scan.SMSYN
Engine.RollingQueues.SaveYN
Update.InitializePackageYN
Engine.GenericCountYN
Platform.UpdateEngine_StartYN
Platform.PersistedCache.CacheStateYN
WdFilter.Hardening.AccessEvent.ObYN
Engine.AR.RootkitScanYN
Engine.BM.ImageNameConfigurationStatsYN
Platform.ProcessScan_StartYN
Engine.ValidateTrust.CatalogSignedPathsYN
Engine.GenericHResultYN
Update.RemoveDirectoryYN
Platform.Maps.LatencyYN
Platform.RTP.SyncProcessCreateStatsYN
Update.EndYN
MpCmdRun.SignatureUpdate_SourceYN
Engine.Core.SigMatchYN
Update.ETWLoggerYN
Update.ProductStateYN
Platform.Maps.SendReportStartYN
Engine.BM.TrackProcessQueueYN
Engine.AtomicCounters.SaveYN
Update.OpenExtractedFileYN
CorePlatform.Sensor.WinningMethodYN
Platform.Hardening.TLProtectServiceStatusYN
Engine.FileHashCache.ResultYN
Platform.Maps.SendReportCompleteYN
Update.ProcessId.OpenProcessYN
Platform.CFA.UpdateStatusYN
Platform.GenericHResultYN
Platform.TamperProtection.ExclusionsStateYN
Engine.BM.ProcessStartDetailsYN
Engine.TrustCheck.FastFriendlyFailNoUSNYN
WdFilter.Hardening.Config.TrustedInstallerFlagsChangedYN
Platform.Configuration.ConfigurationChangedYN
Update.PhaseYN
Engine.Core.EngineInitYN
Update.UpdateProductYN
Engine.BM.DelayedTriggerStatsYN
DC.DisableDeviceControlYN
Update.RemoveStaleMpsigstubYN
Engine.BM.ETWCountYN
Platform.RTP.SyncMonitorStatsYN
Engine.BM.ETWFormatPropFailuresYN
Engine.Lua.ScriptErrorYN
Platform.Hardening.TLProtectTokenStatusYN
Update.InitializeLogYN
Update.BeginYN
Engine.BM.ProcessInfoMapStatsYN
Engine.BM.FileChangeVolumeYN
Engine.ResMgr.ScanExtraResListResultYN
Platform.RTP.DisabledBMYN
Platform.SignatureUpdate.ConfigsYN
Engine.Det.ExhaustiveScriptScanYN
Engine.BM.ShutdownStatsYN
Platform.UpdateEngine_StopYN
Update.ProcessId.GetParentYN
Update.ClientSendReceiveMessageYN

Platform.GenericCount

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
FeatureName
FeatureScenario
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
connectionType
isInbound
reputationMode

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5896
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:25.949Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 7,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FeatureName": "NetworkProtection",
    "FeatureScenario": "ConnectionInfo",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "connectionType": "unknown",
    "isInbound": false,
    "reputationMode": 0
  },
  "message": ""
}

Engine.Scan.SMS

#
Level
4

Fields #

NameDescription
AdvScan
AppVersion
CampRing
Count
EngineRing
EngineVersion
ExitReason
ImageName
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
Level
MemQuerySize_B
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ScanCount
ScanSize_kB
ScanTime_ms
Sha1
ShouldHashIds
SigVersion
SignatureRing
Trigger
WallTime_ms

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5140
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:59:56.691Z",
    "version": 0
  },
  "event_data": {
    "AdvScan": false,
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "ExitReason": "exitproc",
    "ImageName": "wsmprovhost.exe",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "Level": 4,
    "MemQuerySize_B": 59268,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ScanCount": 32,
    "ScanSize_kB": 264968,
    "ScanTime_ms": 10063,
    "Sha1": "",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "Trigger": 210778827871879,
    "WallTime_ms": 46984
  },
  "message": ""
}

Engine.RollingQueues.Save

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
HR
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
NumNamespaces
NumQueues
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:06.784Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "HR": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "NumNamespaces": 2,
    "NumQueues": 1910,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.InitializePackage

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
Location
Name
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:48.280Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 235968,
    "IsAdmin": 1,
    "Location": "C:\\Windows\\Temp\\D8603BDE-1D76-4FD6-BDE0-D2DF6CE1B2311c5c.1dd19416bf0994e",
    "Name": "AM BDD",
    "PartA_PrivTags": 2147483648,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.19"
  },
  "message": ""
}

Engine.GenericCount

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
FeatureName
FeatureScenario
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
MaxDeadNotificationLatency
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5896
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:25.950Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FeatureName": "BM",
    "FeatureScenario": "ProcessContextPurge",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "MaxDeadNotificationLatency": 8,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.UpdateEngine_Start

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:48.649Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.PersistedCache.CacheState

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
SFCState
ShouldHashIds
SigVersion
SignatureRing
TrustedUSN
TrustedUSNState

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:06.784Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "SFCState": 7,
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "TrustedUSN": 476687,
    "TrustedUSNState": 2
  },
  "message": ""
}

WdFilter.Hardening.AccessEvent.Ob

#
Level
4

Fields #

NameDescription
HardenedDesiredAccess
OriginalDesiredAccess
PartA_PrivTags
SourceImageName
TargetImageName

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12140,
      "thread_id": 11284
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:22.095Z",
    "version": 0
  },
  "event_data": {
    "HardenedDesiredAccess": "D4F71F00",
    "OriginalDesiredAccess": "FFFF1F00",
    "PartA_PrivTags": 16777216,
    "SourceImageName": "160063006F006E0068006F00730074002E00650078006500",
    "TargetImageName": "18004D00700043006D006400520075006E002E00650078006500"
  },
  "message": ""
}

Engine.AR.RootkitScan

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
ErrorCode
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 13084
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 20:41:45.214Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 2,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "ErrorCode": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.258.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Engine.BM.ImageNameConfigurationStats

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
ConfigChange
EngineRing
EngineVersion
EnumerationHits
EnumerationMisses
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
MapGenerate
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
SyncStart
SyncStartFailures
SyncStartMapAddFailures

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.641Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "ConfigChange": 0,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "EnumerationHits": 0,
    "EnumerationMisses": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "MapGenerate": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "SyncStart": 4428,
    "SyncStartFailures": 0,
    "SyncStartMapAddFailures": 0
  },
  "message": ""
}

Platform.ProcessScan_Start

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
__TlgCV__

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.262Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "__TlgCV__": "QNiceX2zokGDKqYU.0"
  },
  "message": ""
}

Engine.ValidateTrust.CatalogSignedPaths

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
Path
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 13084
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:08.137Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 2,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "Path": "WinDir",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Engine.GenericHResult

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
FeatureName
FeatureScenario
HResult
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 13084
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:08.137Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 66,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FeatureName": "HIPS",
    "FeatureScenario": "RegExCompile",
    "HResult": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.RemoveDirectory

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.286Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 251410,
    "IsAdmin": 1,
    "PartA_PrivTags": 16777216,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.24",
    "hr": 0
  },
  "message": ""
}

Platform.Maps.Latency

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
ClientLatency
CreateConnectionTime
EngineRing
EngineVersion
GenerateLatency
HResult
HttpStatus
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OnConnectedTick
OnConnectingTick
OnFirstReceivingTick
OnFirstSendingTick
OnResolvedNameTick
OnResolvingNameTick
OnSendEndTick
OnSendStartTick
OrgId
ParseLatency
PartA_PrivTags
PartnerGuid
ProductGuid
ReadResponseTime
ReceiveResponseTime
ReportGuid
SendLatency
SendOverheadTime
SendRequestTime
SendUrlAttempts
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10160
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:40:42.649Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "ClientLatency": 0,
    "CreateConnectionTime": 0,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "GenerateLatency": 0,
    "HResult": 0,
    "HttpStatus": 200,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OnConnectedTick": 4294967295,
    "OnConnectingTick": 4294967295,
    "OnFirstReceivingTick": 32970334,
    "OnFirstSendingTick": 32970086,
    "OnResolvedNameTick": 4294967295,
    "OnResolvingNameTick": 4294967295,
    "OnSendEndTick": 32970334,
    "OnSendStartTick": 32970085,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "ParseLatency": 0,
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ReadResponseTime": 0,
    "ReceiveResponseTime": 0,
    "ReportGuid": "{D92BEEB7-0E40-42EC-B32A-5EC6BB51A192}",
    "SendLatency": 253,
    "SendOverheadTime": 0,
    "SendRequestTime": 249,
    "SendUrlAttempts": 1,
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.RTP.SyncProcessCreateStats

#
Level
4

Fields #

NameDescription
AppVersion
BadDataCount
CampRing
DurationMsCount
DurationMsSum
EngineRing
EngineVersion
FailureCount
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
LastFailureCode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
SuccessCount
TimeoutCount

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.155Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "BadDataCount": 0,
    "CampRing": 4294967295,
    "DurationMsCount": 4428,
    "DurationMsSum": 108886,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FailureCount": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "LastFailureCode": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "SuccessCount": 4428,
    "TimeoutCount": 0
  },
  "message": ""
}

Update.End

#
Level
4

Fields #

NameDescription
CampRing
EngineRing
EventName
EventRVA
IsAdmin
LastExitCode
LastStartTime
PartA_PrivTags
ProgramVersion
ShouldHashIds
SignatureRing
StubName
StubVersion
__TlgCV__
hr
parentName
processName
updateInterval

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.291Z",
    "version": 0
  },
  "event_data": {
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EventName": "",
    "EventRVA": 0,
    "IsAdmin": 1,
    "LastExitCode": 0,
    "LastStartTime": 134290727638895079,
    "PartA_PrivTags": 33554432,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "SignatureRing": 4294967295,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.25",
    "hr": 0,
    "parentName": "wuaucltcore.exe",
    "processName": "mpsigstub.exe",
    "updateInterval": 605026586673
  },
  "message": ""
}

MpCmdRun.SignatureUpdate_Source

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
FallbackOrder
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
Source
dwOptions
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12544,
      "thread_id": 7808
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.440Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FallbackOrder": "MicrosoftUpdateServer|MMPC",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "Source": "UNMANAGED",
    "dwOptions": "08000000",
    "hr": "00000000"
  },
  "message": ""
}

Engine.Core.SigMatch

#
Level
4

Fields #

NameDescription
AppVersion
Cached
CampRing
Count
EngineRing
EngineVersion
FileName
FileSize
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
PathID
Persist
ProductGuid
ShouldHashIds
SigName
SigSeq
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5896
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:25.949Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "Cached": false,
    "CampRing": 4294967295,
    "Count": 2,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FileName": "wsmprovhost.exe",
    "FileSize": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "PathID": "39A590A9",
    "Persist": false,
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigName": "Trojan:Win64/Petwosel.B",
    "SigSeq": "8155BBB778AD0000",
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.ETWLogger

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
IsEnabled
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.618Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 157272,
    "IsAdmin": 1,
    "IsEnabled": 0,
    "PartA_PrivTags": 16777216,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.3",
    "hr": 0
  },
  "message": ""
}

Update.ProductState

#
Level
4

Fields #

NameDescription
AntiSpywareDisabled
CallerRVA
IsAdmin
IsWindowsDefender
OriginAntiSpyware
OriginProductGUID
PartA_PrivTags
ProductDisabled
ProductGUID
ProductName
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.651Z",
    "version": 0
  },
  "event_data": {
    "AntiSpywareDisabled": 0,
    "CallerRVA": 175713,
    "IsAdmin": 1,
    "IsWindowsDefender": true,
    "OriginAntiSpyware": 2,
    "OriginProductGUID": 1,
    "PartA_PrivTags": 33554432,
    "ProductDisabled": 0,
    "ProductGUID": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ProductName": "Microsoft Windows Defender (RS1+)",
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.6"
  },
  "message": ""
}

Platform.Maps.SendReportStart

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ReportSize
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3528
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:40:42.394Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ReportSize": 2853,
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Engine.BM.TrackProcessQueue

#
Level
4

Fields #

NameDescription
AllowingCount
AppVersion
CampRing
DroppingCount
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
NotificationTag
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
Scenario
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.641Z",
    "version": 0
  },
  "event_data": {
    "AllowingCount": 4413,
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "DroppingCount": 0,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "NotificationTag": 1,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "Scenario": "NotificationStats",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Engine.AtomicCounters.Save

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
HR
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
NumNamespaces
NumValues
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:05.039Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "HR": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "NumNamespaces": 2,
    "NumValues": 4,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.OpenExtractedFile

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
expectedHash
filePath
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:48.255Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 280589,
    "IsAdmin": 1,
    "PartA_PrivTags": 16777216,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.16",
    "expectedHash": "80e1844937f1f9fa64bdf4ca38a67763297ce85d7381c8373db723c6811c022d",
    "filePath": "C:\\Windows\\Temp\\D8603BDE-1D76-4FD6-BDE0-D2DF6CE1B2311c5c.1dd19416bf0994e\\1.455.254.0_to_1.455.256.0_mpasdlta.vdm._p",
    "hr": 0
  },
  "message": ""
}

CorePlatform.Sensor.WinningMethod

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
Sensor
ShouldHashIds
SigVersion
SignatureRing
WinningMethod

Example Event #

{
  "system": {
    "channel": "",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3448,
      "thread_id": 10808
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 19:51:35.859Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "",
    "Sensor": "CPU",
    "ShouldHashIds": true,
    "SigVersion": "1.455.258.0",
    "SignatureRing": 4294967295,
    "WinningMethod": "PDH"
  },
  "message": ""
}

Platform.Hardening.TLProtectServiceStatus

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
HRESULT
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
Operation
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ServiceName
ShouldHashIds
SigVersion
SignatureRing
TrustLabelSddl

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.049Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "HRESULT": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "Operation": "Set",
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ServiceName": "WinDefend",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "TrustLabelSddl": "S:P(TL;;CCLCSWRPLOCRRC;;;S-1-19-512-1536)"
  },
  "message": ""
}

Engine.FileHashCache.Result

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
Hit
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5140
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:59:56.691Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 8,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "Hit": false,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.Maps.SendReportComplete

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
Hresult
HttpStatus
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3528
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:40:42.648Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "Hresult": "00000000",
    "HttpStatus": 200,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.ProcessId.OpenProcess

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
desiredAccess
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12752,
      "thread_id": 12892
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.535Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 150781,
    "IsAdmin": 1,
    "PartA_PrivTags": 16777216,
    "ProgramVersion": "1.455.256.0",
    "ShouldHashIds": 1,
    "StubName": "MpWUStub",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.1",
    "desiredAccess": 4096,
    "hr": 0
  },
  "message": ""
}

Platform.CFA.UpdateStatus

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
HResult
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.653Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "HResult": "00000000",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.GenericHResult

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
FeatureName
FeatureScenario
HResult
IsBeta
IsDevMode
IsE5
IsManaged
IsPassiveMode
IsSxsPassiveMode
IsTSMode
OrgId
PartA_PrivTags
PartnerGuid
ProcessName
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5896
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:25.949Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FeatureName": "Platform.TSMode",
    "FeatureScenario": "Platform.TSMode.Query",
    "HResult": 0,
    "IsBeta": false,
    "IsDevMode": false,
    "IsE5": true,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "IsTSMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProcessName": "MsSense.exe",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.TamperProtection.ExclusionsState

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EnableTPExclusions
EnableTPExclusionsFC
EnableTPExclusionsPreviousValue
EngineRing
EngineVersion
IsBeta
IsIntuneManagedDefender
IsManaged
IsPassiveMode
IsSecureConfigEnabled
IsStrictPolicyModeEnabled
IsSxsPassiveMode
IsTPEnabled
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
fDisableTPExclusionsMiscBypass

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.242Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EnableTPExclusions": 0,
    "EnableTPExclusionsFC": 1,
    "EnableTPExclusionsPreviousValue": 0,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsIntuneManagedDefender": 0,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSecureConfigEnabled": 0,
    "IsStrictPolicyModeEnabled": 0,
    "IsSxsPassiveMode": false,
    "IsTPEnabled": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "fDisableTPExclusionsMiscBypass": 0
  },
  "message": ""
}

Engine.BM.ProcessStartDetails

#
Level
4

Fields #

NameDescription
AppVersion
AsyncProcessStart
CampRing
DifferentParent
EngineRing
EngineVersion
FalsePositive
Interesting
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
NoEnvVariables
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShortLiveProcesses
ShouldHashIds
SigVersion
SignatureRing
SyncProcessStart
Uninteresting

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.641Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "AsyncProcessStart": 4413,
    "CampRing": 4294967295,
    "DifferentParent": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FalsePositive": 0,
    "Interesting": 4654,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "NoEnvVariables": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShortLiveProcesses": 0,
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "SyncProcessStart": 4393,
    "Uninteresting": 208
  },
  "message": ""
}

Engine.TrustCheck.FastFriendlyFailNoUSN

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10876
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:04.232Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

WdFilter.Hardening.Config.TrustedInstallerFlagsChanged

#
Level
4

Fields #

NameDescription
CurrentFlags
PartA_PrivTags

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.159Z",
    "version": 0
  },
  "event_data": {
    "CurrentFlags": "03000000",
    "PartA_PrivTags": 2048
  },
  "message": ""
}

Platform.Configuration.ConfigurationChanged

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
ConfigurationName
ConfigurationOrigin
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
KeyName
NewConfigurationValue
OldConfigurationValue
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3528
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.451Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "ConfigurationName": "WdConfigHash",
    "ConfigurationOrigin": 2,
    "EngineRing": 4294967295,
    "EngineVersion": "0.0.0.0",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "KeyName": "CoreService",
    "NewConfigurationValue": "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x34E133C0",
    "OldConfigurationValue": "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5D64DD00",
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "0.0.0.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.Phase

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
Name
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.618Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 215891,
    "IsAdmin": 1,
    "Name": "ProductSearch",
    "PartA_PrivTags": 2147483648,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.5"
  },
  "message": ""
}

Engine.Core.EngineInit

#
Level
4

Fields #

NameDescription
AppVersion
Caller
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:06.930Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "Caller": "Complete",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "hr": 0
  },
  "message": ""
}

Update.UpdateProduct

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
NewASBase
NewASDelta
NewAVBase
NewAVDelta
NewMpEngine
NewNISBase
NewNISEngine
NewNISFull
NewPlatform
OldASBase
OldASDelta
OldAVBase
OldAVDelta
OldMpEngine
OldNISBase
OldNISEngine
OldNISFull
OldPlatform
PackageName
PartA_PrivTags
ProductGUID
ProductName
ProgramVersion
ShouldHashIds
StubName
StubVersion
Update
ValidateUpdate
__TlgCV__

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.250Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 179919,
    "IsAdmin": 1,
    "NewASBase": "0.0.0.0",
    "NewASDelta": "1.455.256.0",
    "NewAVBase": "0.0.0.0",
    "NewAVDelta": "1.455.256.0",
    "NewMpEngine": "0.0.0.0",
    "NewNISBase": "0.0.0.0",
    "NewNISEngine": "0.0.0.0",
    "NewNISFull": "0.0.0.0",
    "NewPlatform": "0.0.0.0",
    "OldASBase": "1.455.0.0",
    "OldASDelta": "1.455.254.0",
    "OldAVBase": "1.455.0.0",
    "OldAVDelta": "1.455.254.0",
    "OldMpEngine": "1.1.26060.3008",
    "OldNISBase": "0.0.0.0",
    "OldNISEngine": "0.0.0.0",
    "OldNISFull": "0.0.0.0",
    "OldPlatform": "4.18.26060.3008",
    "PackageName": "AM BDD",
    "PartA_PrivTags": 33554432,
    "ProductGUID": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ProductName": "Microsoft Windows Defender (RS1+)",
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "Update": 0,
    "ValidateUpdate": 0,
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.23"
  },
  "message": ""
}

Engine.BM.DelayedTriggerStats

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
MaxAsyncDispatchTime
MaxDelayedObject
MaxQueuedObjects
OrgId
PartA_PrivTags
PartnerGuid
ProcessedObjects
ProductGuid
ReceivedObjects
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.612Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "MaxAsyncDispatchTime": 0,
    "MaxDelayedObject": 0,
    "MaxQueuedObjects": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProcessedObjects": 0,
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ReceivedObjects": 0,
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

DC.DisableDeviceControl

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
DeviceControlState
EngineRing
EngineVersion
HRESULT
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 3528
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.462Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "DeviceControlState": 2,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "HRESULT": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Update.RemoveStaleMpsigstub

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.618Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 196824,
    "IsAdmin": 1,
    "PartA_PrivTags": 2147483648,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.4",
    "hr": 0
  },
  "message": ""
}

Engine.BM.ETWCount

#
Level
4

Fields #

NameDescription
AccountChanged
AccountCreated
AllocVmLocal
AllocVmRemote
AmsiInitFailed
ApiLoggerStatus
AppVersion
AuditLoggerStatus
BITSJobCreate
CampRing
ClearSecLog
ClearSysLog
ClrAssemblyLoad
ClrModuleLoad
CreateSymLnk
CredManBackupCredentials
CredManRead
DangerousSyscall
DeviceLoad
DeviceUnload
DirEnum
DriverLoad
DriverUnload
EngineRing
EngineVersion
GetAsyncKeyState
HiveHistoryClear
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
KernelBlock
LDAPSearch
LogonFailure
LogonSuccess
MapViewRemote
OpenProcess
OpenThread
OrgId
PartA_PrivTags
PartnerGuid
PasswordChanged
PasswordReset
ProductGuid
ProtectVmLocal
ProtectVmLocalPreviousRx
ProtectVmRemote
QueueUserApc
ReadClipboard
RegLastChance
RegShutdown
RegisterInput
ResumeProcess
ResumeThread
ScheduledTaskCreate
ScheduledTaskUpdate
SecurityMitigations
ServiceChangeAccount
ServiceChangeBinary
ServiceChangeStart
ServiceHostStart
ServiceStart
ServiceStop
SetEventHook
SetLoadImage
SetThread
SetThreadContext
SetWindowsHook
ShouldHashIds
ShutdownDelay
SigVersion
SignatureRing
StartTime
SuspendProcess
SuspendThread
TerminateProcess
TerminationTime
TotalEventConsumedCount
UserBlock
VaultSvcEnumerateItems
VaultSvcFindItems
VaultSvcGetItem
WDClipWriteClipboard
WMIActivityNew
WMICreateProcess
WMIExecMethod
WriteVmRemote

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.641Z",
    "version": 0
  },
  "event_data": {
    "AccountChanged": 4,
    "AccountCreated": 1,
    "AllocVmLocal": 12371,
    "AllocVmRemote": 0,
    "AmsiInitFailed": 0,
    "ApiLoggerStatus": 7007,
    "AppVersion": "4.18.26060.3008",
    "AuditLoggerStatus": 7007,
    "BITSJobCreate": 5,
    "CampRing": 4294967295,
    "ClearSecLog": 0,
    "ClearSysLog": 0,
    "ClrAssemblyLoad": 0,
    "ClrModuleLoad": 0,
    "CreateSymLnk": 185,
    "CredManBackupCredentials": 0,
    "CredManRead": 148,
    "DangerousSyscall": 0,
    "DeviceLoad": 23,
    "DeviceUnload": 17,
    "DirEnum": 0,
    "DriverLoad": 0,
    "DriverUnload": 0,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "GetAsyncKeyState": 0,
    "HiveHistoryClear": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "KernelBlock": 0,
    "LDAPSearch": 158,
    "LogonFailure": 0,
    "LogonSuccess": 147,
    "MapViewRemote": 0,
    "OpenProcess": 0,
    "OpenThread": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "PasswordChanged": 0,
    "PasswordReset": 1,
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ProtectVmLocal": 501,
    "ProtectVmLocalPreviousRx": 237,
    "ProtectVmRemote": 0,
    "QueueUserApc": 6,
    "ReadClipboard": 0,
    "RegLastChance": 0,
    "RegShutdown": 0,
    "RegisterInput": 18,
    "ResumeProcess": 0,
    "ResumeThread": 0,
    "ScheduledTaskCreate": 9,
    "ScheduledTaskUpdate": 73,
    "SecurityMitigations": 4,
    "ServiceChangeAccount": 0,
    "ServiceChangeBinary": 0,
    "ServiceChangeStart": 22,
    "ServiceHostStart": 82,
    "ServiceStart": 82,
    "ServiceStop": 6,
    "SetEventHook": 1028,
    "SetLoadImage": 0,
    "SetThread": 0,
    "SetThreadContext": 0,
    "SetWindowsHook": 1516,
    "ShouldHashIds": true,
    "ShutdownDelay": 16940,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "StartTime": 134290727825776224,
    "SuspendProcess": 0,
    "SuspendThread": 0,
    "TerminateProcess": 274,
    "TerminationTime": 134291332876409882,
    "TotalEventConsumedCount": 7306,
    "UserBlock": 0,
    "VaultSvcEnumerateItems": 0,
    "VaultSvcFindItems": 0,
    "VaultSvcGetItem": 0,
    "WDClipWriteClipboard": 0,
    "WMIActivityNew": 0,
    "WMICreateProcess": 0,
    "WMIExecMethod": 0,
    "WriteVmRemote": 25
  },
  "message": ""
}

Platform.RTP.SyncMonitorStats

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
SyncMonitorRequestDuration
SyncMonitorState
SyncMonitoringType

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.155Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "SyncMonitorRequestDuration": 100000000,
    "SyncMonitorState": 1,
    "SyncMonitoringType": 0
  },
  "message": ""
}

Engine.BM.ETWFormatPropFailures

#
Level
4

Fields #

NameDescription
AccountChanged
AccountCreated
AllocVmLocal
AllocVmRemote
AppVersion
BITSJobCreate
CampRing
ClearSecLog
ClearSysLog
ClrAssemblyLoad
ClrModuleLoad
CreateSymLnk
CredManBackupCredentials
CredManRead
DangerousSyscall
DeviceLoad
DeviceUnload
DirEnum
DriverLoad
DriverUnload
EngineRing
EngineVersion
FormatterType
GetAsyncKeyState
HiveHistoryClear
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
KernelBlock
LDAPSearch
LogonFailure
LogonSuccess
MapViewRemote
OpenProcess
OpenThread
OrgId
PartA_PrivTags
PartnerGuid
PasswordChanged
PasswordReset
ProductGuid
ProtectVmLocal
ProtectVmRemote
QueueUserApc
ReadClipboard
RegLastChance
RegShutdown
RegisterInput
ResumeProcess
ResumeThread
ScheduledTaskCreate
ScheduledTaskUpdate
SecurityMitigations
ServiceChangeAccount
ServiceChangeBinary
ServiceChangeStart
ServiceHostStart
ServiceStart
ServiceStop
SetEventHook
SetLoadImage
SetThread
SetThreadContext
SetWindowsHook
ShouldHashIds
SigVersion
SignatureRing
SuspendProcess
SuspendThread
TerminateProcess
UserBlock
VaultSvcEnumerateItems
VaultSvcFindItems
VaultSvcGetItem
WMIActivityNew
WMIExecMethod
WriteVmRemote

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.641Z",
    "version": 0
  },
  "event_data": {
    "AccountChanged": 0,
    "AccountCreated": 0,
    "AllocVmLocal": 0,
    "AllocVmRemote": 0,
    "AppVersion": "4.18.26060.3008",
    "BITSJobCreate": 0,
    "CampRing": 4294967295,
    "ClearSecLog": 0,
    "ClearSysLog": 0,
    "ClrAssemblyLoad": 0,
    "ClrModuleLoad": 0,
    "CreateSymLnk": 0,
    "CredManBackupCredentials": 0,
    "CredManRead": 0,
    "DangerousSyscall": 0,
    "DeviceLoad": 0,
    "DeviceUnload": 0,
    "DirEnum": 0,
    "DriverLoad": 0,
    "DriverUnload": 0,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FormatterType": 2,
    "GetAsyncKeyState": 0,
    "HiveHistoryClear": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "KernelBlock": 0,
    "LDAPSearch": 0,
    "LogonFailure": 0,
    "LogonSuccess": 0,
    "MapViewRemote": 0,
    "OpenProcess": 0,
    "OpenThread": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "PasswordChanged": 0,
    "PasswordReset": 0,
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ProtectVmLocal": 0,
    "ProtectVmRemote": 0,
    "QueueUserApc": 0,
    "ReadClipboard": 0,
    "RegLastChance": 0,
    "RegShutdown": 0,
    "RegisterInput": 0,
    "ResumeProcess": 0,
    "ResumeThread": 0,
    "ScheduledTaskCreate": 0,
    "ScheduledTaskUpdate": 0,
    "SecurityMitigations": 0,
    "ServiceChangeAccount": 0,
    "ServiceChangeBinary": 0,
    "ServiceChangeStart": 0,
    "ServiceHostStart": 0,
    "ServiceStart": 0,
    "ServiceStop": 0,
    "SetEventHook": 0,
    "SetLoadImage": 0,
    "SetThread": 0,
    "SetThreadContext": 0,
    "SetWindowsHook": 0,
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "SuspendProcess": 0,
    "SuspendThread": 0,
    "TerminateProcess": 0,
    "UserBlock": 0,
    "VaultSvcEnumerateItems": 0,
    "VaultSvcFindItems": 0,
    "VaultSvcGetItem": 0,
    "WMIActivityNew": 0,
    "WMIExecMethod": 0,
    "WriteVmRemote": 0
  },
  "message": ""
}

Engine.Lua.ScriptError

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
ErrorMsg
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigName
SigSeq
SigVersion
SignatureAgeDays
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10764
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:32.109Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "ErrorMsg": "?:0: attempt to index global 'peattributes' (a nil value). stacktrace: main:0 <-",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigName": "4878dc469dd0",
    "SigSeq": 200924812356247,
    "SigVersion": "1.455.254.0",
    "SignatureAgeDays": 0,
    "SignatureRing": 4294967295
  },
  "message": ""
}

Platform.Hardening.TLProtectTokenStatus

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
HRESULT
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
Operation
OrgId
PartA_PrivTags
PartnerGuid
ProcessName
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
TrustLabelSddl

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.051Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "HRESULT": 0,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "Operation": "Set",
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProcessName": "MsMpEng.exe",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "TrustLabelSddl": "S:P(TL;;DCLCSWRPRC;;;S-1-19-512-1536)"
  },
  "message": ""
}

Update.InitializeLog

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
hr
maxRetries
retry

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7260,
      "thread_id": 12608
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.617Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 210622,
    "IsAdmin": 1,
    "PartA_PrivTags": 2147483648,
    "ProgramVersion": "1.1.24010.2001",
    "ShouldHashIds": 1,
    "StubName": "MpSigStub.exe",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.5.1",
    "hr": 0,
    "maxRetries": 120,
    "retry": 0
  },
  "message": ""
}

Update.Begin

#
Level
4

Fields #

NameDescription
CampRing
CommandLine
EngineRing
Is32Bit
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
SignatureRing
StubName
StubVersion
__TlgCV__
hMainModule
parentName
processName

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12752,
      "thread_id": 12892
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.534Z",
    "version": 0
  },
  "event_data": {
    "CampRing": 4294967295,
    "CommandLine": "\"C:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_Delta_Patch_1.455.254.0.exe\" WD /q",
    "EngineRing": 4294967295,
    "Is32Bit": false,
    "IsAdmin": true,
    "PartA_PrivTags": 33554432,
    "ProgramVersion": "1.455.256.0",
    "ShouldHashIds": 1,
    "SignatureRing": 4294967295,
    "StubName": "MpWUStub",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.0",
    "hMainModule": "0000CD44F67F0000",
    "parentName": "wuaucltcore.exe",
    "processName": "am_delta_patch_1.455.254.0.exe"
  },
  "message": ""
}

Engine.BM.ProcessInfoMapStats

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
MapFullCount
MaxEmptyOrphans
MaxFullBackupTime
MaxNonEmptyOrphans
MaxOrphanCleanupTime
NoMetaStoreEnabled
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 13084
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.714Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "MapFullCount": 0,
    "MaxEmptyOrphans": 0,
    "MaxFullBackupTime": 0,
    "MaxNonEmptyOrphans": 0,
    "MaxOrphanCleanupTime": 0,
    "NoMetaStoreEnabled": 1,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Engine.BM.FileChangeVolume

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
Duplicate
EngineRing
EngineVersion
Excluded
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
Throttled

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 5896
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:37:25.949Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 6,
    "Duplicate": 3,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "Excluded": 5,
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "Throttled": 0
  },
  "message": ""
}

Engine.ResMgr.ScanExtraResListResult

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
finalRet != 1168L ? HRESULT_FROM_WIN32(finalRet) : ((HRESULT)1L)

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10876
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:04.233Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "finalRet != 1168L ? HRESULT_FROM_WIN32(finalRet) : ((HRESULT)1L)": 1
  },
  "message": ""
}

Platform.RTP.DisabledBM

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
FailedFunction
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.247Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FailedFunction": "",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "hr": 0
  },
  "message": ""
}

Platform.SignatureUpdate.Configs

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
FallbackOrder
IsASUpdateDue
IsAVUpdateDue
IsBeta
IsFileShareMissingOrEmpty
IsFileShareReachable
IsManaged
IsPassiveMode
IsSxsPassiveMode
IsWUEnabled
LastSignatureUpdateTime
OrgId
PartA_PrivTags
PartnerGuid
ProductFeature
ProductGuid
ShouldHashIds
SigVersion
SignatureRing

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3960,
      "thread_id": 8016
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:21.993Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "FallbackOrder": "MicrosoftUpdateServer|MMPC",
    "IsASUpdateDue": false,
    "IsAVUpdateDue": false,
    "IsBeta": false,
    "IsFileShareMissingOrEmpty": true,
    "IsFileShareReachable": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "IsWUEnabled": true,
    "LastSignatureUpdateTime": "2026-07-21 01:59:42.615Z",
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductFeature": "00000000",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295
  },
  "message": ""
}

Engine.Det.ExhaustiveScriptScan

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
Count
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
Source

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 13084
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:50:09.300Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "Count": 1,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "Source": "Attrib"
  },
  "message": ""
}

Engine.BM.ShutdownStats

#
Level
4

Fields #

NameDescription
AppVersion
AverageNotificationVisitCount
BMStartTime
CampRing
DetectionsCount
DroppedDetectionsCount
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
MaxActiveConnections
MaxConcurrentLiveContexts
MaxConcurrentNotifications
MaxDetectionListSize
MaxNotificationVisitCount
MaxProcessQueueSize
MaxUnknownStateConnections
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
TokenizedTestDetectionCallCount
TotalNotificationsDropped
TotalNotificationsProcessed
TotalNotificationsPropogated
TotalNotificationsQueued
TotalTestDetectionCallCount

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 10668
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.641Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "AverageNotificationVisitCount": 1,
    "BMStartTime": 134290727825760371,
    "CampRing": 4294967295,
    "DetectionsCount": 59,
    "DroppedDetectionsCount": 39,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "MaxActiveConnections": 101,
    "MaxConcurrentLiveContexts": 374,
    "MaxConcurrentNotifications": 6997,
    "MaxDetectionListSize": 50,
    "MaxNotificationVisitCount": 5,
    "MaxProcessQueueSize": 85,
    "MaxUnknownStateConnections": 0,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 16777216,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.254.0",
    "SignatureRing": 4294967295,
    "TokenizedTestDetectionCallCount": 18,
    "TotalNotificationsDropped": 0,
    "TotalNotificationsProcessed": 286695,
    "TotalNotificationsPropogated": 19947,
    "TotalNotificationsQueued": 289908,
    "TotalTestDetectionCallCount": 295071
  },
  "message": ""
}

Platform.UpdateEngine_Stop

#
Level
4

Fields #

NameDescription
AppVersion
CampRing
EngineRing
EngineVersion
IsBeta
IsManaged
IsPassiveMode
IsSxsPassiveMode
OrgId
PartA_PrivTags
PartnerGuid
ProductGuid
ShouldHashIds
SigVersion
SignatureRing
hr

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4356,
      "thread_id": 6816
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.244Z",
    "version": 0
  },
  "event_data": {
    "AppVersion": "4.18.26060.3008",
    "CampRing": 4294967295,
    "EngineRing": 4294967295,
    "EngineVersion": "1.1.26060.3008",
    "IsBeta": false,
    "IsManaged": false,
    "IsPassiveMode": false,
    "IsSxsPassiveMode": false,
    "OrgId": "ae463dc4-05cb-4fe3-81f7-76a6a9fea3e2",
    "PartA_PrivTags": 33554432,
    "PartnerGuid": "",
    "ProductGuid": "77BDAF73-B396-481F-9042-AD358843EC24",
    "ShouldHashIds": true,
    "SigVersion": "1.455.256.0",
    "SignatureRing": 4294967295,
    "hr": "00000000"
  },
  "message": ""
}

Update.ProcessId.GetParent

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
ParentFound
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12752,
      "thread_id": 12892
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:47:46.542Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 147955,
    "IsAdmin": 1,
    "ParentFound": true,
    "PartA_PrivTags": 16777216,
    "ProgramVersion": "1.455.256.0",
    "ShouldHashIds": 1,
    "StubName": "MpWUStub",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.3"
  },
  "message": ""
}

Update.ClientSendReceiveMessage

#
Level
4

Fields #

NameDescription
CallerRVA
IsAdmin
PartA_PrivTags
ProgramVersion
ShouldHashIds
StubName
StubVersion
__TlgCV__
hr
isLastPackage

Example Event #

{
  "system": {
    "channel": "",
    "computer": "JD-WIN11-22H2-1",
    "correlation": {},
    "event_id": 0,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12752,
      "thread_id": 12892
    },
    "guid": "7AF898D7-7E0E-518D-5F96-B1E79239484C",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft.Windows.Defender",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 18:48:07.297Z",
    "version": 0
  },
  "event_data": {
    "CallerRVA": 135378,
    "IsAdmin": 1,
    "PartA_PrivTags": 33554432,
    "ProgramVersion": "1.455.256.0",
    "ShouldHashIds": 1,
    "StubName": "MpWUStub",
    "StubVersion": "1.1.24010.2001",
    "__TlgCV__": "GbCe5P7fYEmXHT/9.8",
    "hr": 0,
    "isLastPackage": 0
  },
  "message": ""
}