Endpoint protection component

2actions

1reasons

1sources

Livestatus

One protection component of the endpoint protection product, such as real-time scanning.

Identified by: sparklogs.config_change.target, which carries a name.

Action	Reported by	What that reason says
disabled	av_protection_disabled on Microsoft Defender Antivirus event log	Microsoft Defender protection was disabled, or later re-enabled for the same protection family.
enabled	av_protection_disabled on Microsoft Defender Antivirus event log	Microsoft Defender protection was disabled, or later re-enabled for the same protection family.