mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 08:58:41 +00:00
0b66bc4a9b
Adds policy and query to verify Windows Defender is installed and working on Windows. https://github.com/fleetdm/fleet/issues/18494
10 lines
No EOL
523 B
YAML
10 lines
No EOL
523 B
YAML
- name: Collect Windows Defender
|
|
automations_enabled: false
|
|
description: Collects the pid, process name, user, path and command line for Windows Defender installed on hosts.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: snapshot
|
|
min_osquery_version: ""
|
|
observer_can_run: true
|
|
platform: "windows"
|
|
query: SELECT processes.pid, processes.name, users.username, processes.path, processes.cmdline FROM processes LEFT JOIN users ON processes.uid = users.uid WHERE processes.path != '' AND name LIKE 'MpCmdRun.exe'; |