SecurityCenter

Event	Title	Channel	Sample	Rule
1	The Windows Security Center Service has started.	Application	Y	N
2	The Windows Security Center Service has stopped.	Application	Y	N
15	Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.	Application	Y	N
16	Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.	Application	Y	N

Event ID 1: The Windows Security Center Service has started.

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "SecurityCenter",
    "guid": "",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-29T16:38:24.8790324+00:00",
    "event_record_id": 4744,
    "correlation": {},
    "execution": {
      "process_id": 7000,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "The Windows Security Center Service has started."
}

Event ID 2: The Windows Security Center Service has stopped.

Channel: Application
Level: Informational

Example Event #

{
  "system": {
    "provider": "SecurityCenter",
    "guid": "",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2023-11-05T22:31:36.782611+00:00",
    "event_record_id": 1536,
    "correlation": {},
    "execution": {
      "process_id": 7732,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "The Windows Security Center Service has stopped."
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 15: Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data`

Example Event #

{
  "system": {
    "provider": "SecurityCenter",
    "guid": "",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T09:23:24.0855997+00:00",
    "event_record_id": 6609,
    "correlation": {},
    "execution": {
      "process_id": 7000,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Windows Defender",
    "Data_1": "SECURITY_PRODUCT_STATE_ON"
  },
  "message": "Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON."
}

Event ID 16: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.

Channel: Application
Level: Error

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "SecurityCenter",
    "guid": "",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2025-12-31T19:37:29.959155+00:00",
    "event_record_id": 138,
    "correlation": {},
    "execution": {
      "process_id": 1736,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "WIN11-22H2-X64",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "Windows Defender",
      "SECURITY_PRODUCT_STATE_ON"
    ],
    "Binary": "AgAAAA=="
  },
  "message": "Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON."
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline