Microsoft-Windows-SystemHealthAgent

EventTitleChannelSampleRule
1000The Windows Security Health Agent detected a change in the status of …OperationalNN
1001The Windows Security Health Agent detected a change in the status of …OperationalNN
1002The Windows Security Health Agent was initialized successfully.OperationalNN
1003The Windows Security Health Agent could not be initialized.OperationalNN
1004The Windows Security Health Agent was uninitialized successfully.OperationalNN
1005The Windows Security Health Agent completed an online scan.OperationalNN
1006The Windows Security Health Agent failed to complete an online scan.OperationalNN
1007The Windows Security Health Agent completed an offline scan.OperationalNN
1008The Windows Security Health Agent failed to complete an offline scan.OperationalNN
1009The Windows Security Health Agent completed a download of security updates.OperationalNN
1010The Windows Security Health Agent failed to complete a download of security …OperationalNN
1011The Windows Security Health Agent completed an install of security updates.OperationalNN
1012The Windows Security Health Agent failed to complete an install of security …OperationalNN
1013Automatic remediation for firewall succeeded.OperationalNN
1014Automatic remediation for firewall failed.OperationalNN
1015Automatic remediation for Automatic Updates succeeded.OperationalNN
1016Automatic remediation for Automatic Updates failed.OperationalNN
1017Automatic remediation for Windows Security Center service succeeded.OperationalNN
1018Automatic remediation for Windows Security Center service failed.OperationalNN
1019Automatic remediation for antispyware succeeded.OperationalNN
1020Automatic remediation for antispyware failed.OperationalNN
1021Automatic remediation for antispyware signatures succeeded.OperationalNN
1022Automatic remediation for antispyware signatures failed.OperationalNN
1023The Windows Security Center detected a system health state change.OperationalNN
1024Windows Security Center detected a system health state change but the Windows …OperationalNN
1025The Windows Security Health Agent specified a new security health state for the …OperationalNN
1026The Windows Security Health Agent failed to specify a new security health state …OperationalNN
1027The Windows Security Health Agent notified the Windows Network Access Protection …OperationalNN
1028The Windows Security Health Agent failed to notify the Windows Network Access …OperationalNN
1029The Windows Security Health Agent successfully processed a response from the …OperationalNN
1030The Windows Security Health Agent failed to process a response from the Windows …OperationalNN

Event ID 1000: The Windows Security Health Agent detected a change in the status of {ProductCategory}.

#
Channel
Operational

Fields #

NameDescription
ProductCategory

Event ID 1001: The Windows Security Health Agent detected a change in the status of {ProductCategory}.

#
Channel
Operational

Fields #

NameDescription
ProductCategory

Event ID 1002: The Windows Security Health Agent was initialized successfully.

#
Channel
Operational

Message #

The Windows Security Health Agent was initialized successfully. Scan Interval: {ScanInterval} minutes.Time delay before first scan: {StartScanAfter} seconds.Time interval between manual remediation state change: {ManualRemediationStateChangeCheckInterval} seconds.Manual remediation timeout interval: {ManualRemediationTimeoutInterval} seconds.

Fields #

NameDescription
ScanInterval
StartScanAfter
ManualRemediationStateChangeCheckInterval
ManualRemediationTimeoutInterval

Event ID 1003: The Windows Security Health Agent could not be initialized.

#
Channel
Operational

Description

The Windows Security Health Agent could not be initialized. Failure Code: {FailureCode}.

Message #

The Windows Security Health Agent could not be initialized. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1004: The Windows Security Health Agent was uninitialized successfully.

#
Channel
Operational

Event ID 1005: The Windows Security Health Agent completed an online scan.

#
Channel
Operational

Event ID 1006: The Windows Security Health Agent failed to complete an online scan.

#
Channel
Operational

Description

The Windows Security Health Agent failed to complete an online scan.Failure Code: {FailureCode}.

Message #

The Windows Security Health Agent failed to complete an online scan.Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1007: The Windows Security Health Agent completed an offline scan.

#
Channel
Operational

Event ID 1008: The Windows Security Health Agent failed to complete an offline scan.

#
Channel
Operational

Description

The Windows Security Health Agent failed to complete an offline scan.Failure Code: {FailureCode}.

Message #

The Windows Security Health Agent failed to complete an offline scan.Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1009: The Windows Security Health Agent completed a download of security updates.

#
Channel
Operational

Event ID 1010: The Windows Security Health Agent failed to complete a download of security updates.

#
Channel
Operational

Description

The Windows Security Health Agent failed to complete a download of security updates.Failure Code: {FailureCode}.

Message #

The Windows Security Health Agent failed to complete a download of security updates.Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1011: The Windows Security Health Agent completed an install of security updates.

#
Channel
Operational

Event ID 1012: The Windows Security Health Agent failed to complete an install of security updates.

#
Channel
Operational

Description

The Windows Security Health Agent failed to complete an install of security updates.Failure Code: {FailureCode}.

Message #

The Windows Security Health Agent failed to complete an install of security updates.Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1013: Automatic remediation for firewall succeeded.

#
Channel
Operational

Description

Automatic remediation for firewall succeeded. Windows Firewall was turned on successfully.

Message #

Automatic remediation for firewall succeeded. Windows Firewall was turned on successfully.

Event ID 1014: Automatic remediation for firewall failed.

#
Channel
Operational

Description

Automatic remediation for firewall failed. Windows could not turn on Windows Firewall. Failure Code: {FailureCode}.

Message #

Automatic remediation for firewall failed. Windows could not turn on Windows Firewall. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1015: Automatic remediation for Automatic Updates succeeded.

#
Channel
Operational

Description

Automatic remediation for Automatic Updates succeeded. Automatic Updates was turned on successfully.

Message #

Automatic remediation for Automatic Updates succeeded. Automatic Updates was turned on successfully.

Event ID 1016: Automatic remediation for Automatic Updates failed.

#
Channel
Operational

Description

Automatic remediation for Automatic Updates failed. Windows could not turn on Automatic Updates. Failure Code: {FailureCode}.

Message #

Automatic remediation for Automatic Updates failed. Windows could not turn on Automatic Updates. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1017: Automatic remediation for Windows Security Center service succeeded.

#
Channel
Operational

Description

Automatic remediation for Windows Security Center service succeeded. Windows Security Center service was turned on successfully.

Message #

Automatic remediation for Windows Security Center service succeeded. Windows Security Center service was turned on successfully.

Event ID 1018: Automatic remediation for Windows Security Center service failed.

#
Channel
Operational

Description

Automatic remediation for Windows Security Center service failed. Windows could not turn on Windows Security Center service. Failure Code: {FailureCode}.

Message #

Automatic remediation for Windows Security Center service failed. Windows could not turn on Windows Security Center service. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1019: Automatic remediation for antispyware succeeded.

#
Channel
Operational

Description

Automatic remediation for antispyware succeeded. Windows defender was turned on successfully.

Message #

Automatic remediation for antispyware succeeded. Windows defender was turned on successfully.

Event ID 1020: Automatic remediation for antispyware failed.

#
Channel
Operational

Description

Automatic remediation for antispyware failed. Windows could not turn on Windows Defender. Failure Code: {FailureCode}.

Message #

Automatic remediation for antispyware failed. Windows could not turn on Windows Defender. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1021: Automatic remediation for antispyware signatures succeeded.

#
Channel
Operational

Description

Automatic remediation for antispyware signatures succeeded. Windows Defender signatures were updated successfully.

Message #

Automatic remediation for antispyware signatures succeeded. Windows Defender signatures were updated successfully.

Event ID 1022: Automatic remediation for antispyware signatures failed.

#
Channel
Operational

Description

Automatic remediation for antispyware signatures failed. Windows could not update signatures for Windows Defender. Failure Code: {FailureCode}.

Message #

Automatic remediation for antispyware signatures failed. Windows could not update signatures for Windows Defender. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1023: The Windows Security Center detected a system health state change.

#
Channel
Operational

Description

The Windows Security Center detected a system health state change. The change in state was also successfully detected by the Windows Security Health Agent.

Message #

The Windows Security Center detected a system health state change. The change in state was also successfully detected by the Windows Security Health Agent.

Event ID 1024: Windows Security Center detected a system health state change but the Windows Security Health Agent could not enumerate the state change.

#
Channel
Operational

Description

Windows Security Center detected a system health state change but the Windows Security Health Agent could not enumerate the state change. Failure Code: {FailureCode}.

Message #

Windows Security Center detected a system health state change but the Windows Security Health Agent could not enumerate the state change. Failure Code: {FailureCode}

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1025: The Windows Security Health Agent specified a new security health state for the computer.

#
Channel
Operational

Description

The Windows Security Health Agent specified a new security health state for the computer.The correlation id for this transaction is {SuccessString}.

Message #

The Windows Security Health Agent specified a new security health state for the computer.The correlation id for this transaction is {SuccessString}

Fields #

NameDescription
SuccessString

Event ID 1026: The Windows Security Health Agent failed to specify a new security health state for the computer.

#
Channel
Operational

Description

The Windows Security Health Agent failed to specify a new security health state for the computer. Failure Code: {FailureCode}. The correlation id for this transaction is {FailureString}.

Message #

The Windows Security Health Agent failed to specify a new security health state for the computer. Failure Code: {FailureCode}. The correlation id for this transaction is {FailureString}

Fields #

NameDescription
FailureCodeNTSTATUS reference
FailureString

Event ID 1027: The Windows Security Health Agent notified the Windows Network Access Protection Service of a change in the security health state of the computer.

#
Channel
Operational

Event ID 1028: The Windows Security Health Agent failed to notify the Windows Network Access Protection Service of a change in the security health state of the co...

#
Channel
Operational

Description

The Windows Security Health Agent failed to notify the Windows Network Access Protection Service of a change in the security health state of the computer. Failure Code: {FailureCode}.

Message #

The Windows Security Health Agent failed to notify the Windows Network Access Protection Service of a change in the security health state of the computer. Failure Code: {FailureCode}.

Fields #

NameDescription
FailureCodeNTSTATUS reference

Event ID 1029: The Windows Security Health Agent successfully processed a response from the Windows Security Health Validator.

#
Channel
Operational

Description

The Windows Security Health Agent successfully processed a response from the Windows Security Health Validator. The correlation id for this transaction is {SuccessString}.

Message #

The Windows Security Health Agent successfully processed a response from the Windows Security Health Validator. The correlation id for this transaction is {SuccessString}.

Fields #

NameDescription
SuccessString

Event ID 1030: The Windows Security Health Agent failed to process a response from the Windows Security Health Validator.

#
Channel
Operational

Description

The Windows Security Health Agent failed to process a response from the Windows Security Health Validator. Failure Code: {FailureCode}.The correlation id for this transaction is {FailureString}.

Message #

The Windows Security Health Agent failed to process a response from the Windows Security Health Validator. Failure Code: {FailureCode}.The correlation id for this transaction is {FailureString}.

Fields #

NameDescription
FailureCodeNTSTATUS reference
FailureString