Microsoft Defender Antivirus event log
Windows Defender/Operational event channel: malware detections and the remediation chain, protection disabled and re-enabled, configuration changes that resemble tampering, definition and engine failures, ASR and network-protection blocks, and the heartbeat and scan lifecycle retained at the Debug severity tier. The health-center channel (WHC) is collected too when the host has it. The channel does not exist on Windows Server 2012 R2, where this source yields nothing. Nothing is deleted; routine events are lowered in severity, not removed.
Feed id: win.defender.eventlog.
Channels
This feed binds 2 Windows Event Log channels as one reporting axis. A channel that a given Windows edition, role or OEM does not provide is absent on that endpoint; the rest still collect.
| Channel | Ticket class |
|---|---|
Microsoft-Windows-Windows Defender/Operational | |
Microsoft-Windows-Windows Defender/WHC |
Fields
| Field | Type | Unit | Meaning |
|---|---|---|---|
win.defender.eventlog.threat_name | string | Threat identity from the detection/remediation family (1116-1119, legacy 1006-1008, 1015): Threat Name. | |
win.defender.eventlog.severity_id | int | Numeric threat severity from 1116/1006 (Severity ID: 1 Low, 2 Moderate, 4 High, 5 Severe). Locale-safe, so prefer it over the rendered name. | |
win.defender.eventlog.severity_name | string | Rendered threat severity text from 1116/1006 (Severity Name). Locale-sensitive fallback read only when Severity ID is absent. | |
win.defender.eventlog.category_id | int | Numeric threat category from 1116/1006 (Category ID). | |
win.defender.eventlog.category_name | string | Rendered threat category text from 1116/1006 (Category Name). | |
win.defender.eventlog.threat_path | string | File/object path the threat/rule acted on: 1116-1119 (legacy 1006-1008), 1015 (Path), 1121 ASR block (Path). | |
win.defender.eventlog.detection_origin | string | Where the detection originated, from 1116/1006 (Detection Origin). | |
win.defender.eventlog.detection_type | string | Detection mechanism kind, from 1116/1006 (Detection Type). | |
win.defender.eventlog.detection_source | string | Detection source engine/component, from 1116/1006 (Detection Source). | |
win.defender.eventlog.user | string | User context Defender associated with the event: detection (User), scan lifecycle (1000/1001, User). | |
win.defender.eventlog.action_id | int | Numeric remediation action from 1117/1007 (Action ID). | |
win.defender.eventlog.action_name | string | Rendered remediation action text from 1117/1007 (Action Name, downcased). Locale-sensitive, so an allow on a non-English system reads in the local language. | |
win.defender.eventlog.status | string | Result code as logged (Error Code): 1117/1007 remediation outcome, 1118/1119/1008 remediation failure, 1005 scan failure, 2001/2003/2004 definition update failure, 3002/5008 engine failure. The remediation ids state a completed action as a zero here, so the value is the outcome and not a failure claim. | |
win.defender.eventlog.new_value | string | 5007 config-change new value (New Value): the setting content Defender wrote, never message text. Exclusions, real-time monitoring, anti-spyware, tamper protection and cloud reporting are the settings this value names on a tamper-shaped change. | |
win.defender.eventlog.old_value | string | 5007 config-change prior value (Old Value). | |
win.defender.eventlog.sig_version | string | Current security intelligence version: 2000/2002/2010/2014 update lifecycle, 2001/2003/2004 update failure (Current security intelligence Version). | |
win.defender.eventlog.sig_version_previous | string | Prior security intelligence version, same id family as sig_version (Previous security intelligence Version). | |
win.defender.eventlog.scan_id | string | Scan lifecycle join key: 1000/1001 (start/finish), 1002 (cancelled), 1005 (failed) (Scan ID). | |
win.defender.eventlog.feature_name | string | RTP feature name: 3002/5008 (engine failure), 3007 (recovery) (Feature Name). | |
win.defender.eventlog.rule_id | string | ASR rule GUID from 1121 block (ID). | |
win.defender.eventlog.filename | string | 2050 file-upload-for-analysis filename (Filename). | |
win.defender.eventlog.sha256 | string | 2050 file-upload-for-analysis hash (Sha256); join key with filename. |
Curated reasons
Severity here is what the condition is worth to the person holding the ticket, not the level the provider stated for itself.
| Reason | Ticket class | Severity |
|---|---|---|
av_config_changed | endpoint_protection | Warning |
av_definition_update_failed | endpoint_protection | Error / Warning |
av_engine_failed | endpoint_protection | Error |
av_protection_disabled | endpoint_protection | Serious or Notice |
av_scan_failed | endpoint_protection | Warning |
av_suspicious_behavior_detected | endpoint_protection | Warning |
av_tamper_blocked | endpoint_protection | Warning |
av_threat_detected | endpoint_protection | Error or Warning |
av_threat_not_remediated | endpoint_protection | Serious |
av_threat_remediated | endpoint_protection | Warning |
av_threat_remediation_failed | endpoint_protection | Error |
defender_asr_blocked | endpoint_protection | Warning |
defender_network_protection_blocked | endpoint_protection | Warning |
av_config_changed
Microsoft Defender recorded a configuration change to a protection-sensitive setting.
Severity: Warning
Impact: Exclusions or protection settings may have changed, which can weaken prevention, detection, or cloud reporting.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 5007
Where to look next:
- Review Old Value and New Value.
- Check whether the change came from approved GPO, Intune, or EDR policy.
Related reasons:
av_protection_disabled: protection state changed directlyav_tamper_blocked: attempted settings change blocked by tamper protection
Fields it can set: win.defender.eventlog.new_value, win.defender.eventlog.old_value
av_definition_update_failed
Microsoft Defender failed to update or reverted security intelligence.
Severity: Error / Warning
Impact: Defender may scan with stale or rolled-back signatures until a later update succeeds.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 2001, 2003, 2004
Where to look next:
- Review Current and Previous security intelligence Version.
- Look for later successful update events before opening a stale-definitions incident.
Related reasons:
av_engine_failed: engine failure rather than update failureav_scan_failed: scan coverage issue
Fields it can set: win.defender.eventlog.sig_version, win.defender.eventlog.sig_version_previous, win.defender.eventlog.status
av_engine_failed
Microsoft Defender reported a protection feature or engine failure.
Severity: Error
Impact: Endpoint protection may be degraded until the feature or engine recovers.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 3002, 5008
Where to look next:
- Review Feature Name and Error Code.
- Look for later 3007 recovery context.
Related reasons:
av_definition_update_failed: update path failureav_protection_disabled: explicit protection-state change
Fields it can set: win.defender.eventlog.feature_name, win.defender.eventlog.status
av_protection_disabled
Microsoft Defender protection was disabled, or later re-enabled for the same protection family.
Severity: Serious or Notice
Impact: While disabled, Defender may not provide the expected real-time, antispyware, or antivirus protection for the host.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 5000, 5001, 5009, 5010, 5011, 5012
| Case | Severity | Ticket class |
|---|---|---|
disabled | Serious | endpoint_protection |
enabled | Notice | endpoint_protection |
Where to look next:
- Check whether Intune, GPO, installer activity, or an admin action caused the change.
- Pair disabled and enabled events before judging duration.
Related reasons:
av_config_changed: configuration changes that can weaken protectionav_engine_failed: engine failure can also reduce protectionav_tamper_blocked: attempted change blocked by tamper protection
av_scan_failed
A Microsoft Defender scan failed before completing.
Severity: Warning
Impact: The host may have missed scheduled or requested malware scanning coverage for that run.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1005
Where to look next:
- Review Scan ID and Error Code.
- Distinguish scan failed from scan cancelled.
Related reasons:
av_definition_update_failed: stale definitions can reduce scan valueav_threat_detected: what a later scan may find
Fields it can set: win.defender.eventlog.scan_id, win.defender.eventlog.status
av_suspicious_behavior_detected
Microsoft Defender behavior monitoring detected suspicious behavior.
Severity: Warning
Impact: A process or file behaved in a way Defender considered suspicious; later threat outcome events may clarify whether it was blocked or cleaned.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1015
Where to look next:
- Review Threat Name, Path, and Process Name.
- Look for adjacent detection or remediation events.
Related reasons:
av_threat_detected: malware or PUA detection in the same channelav_threat_remediation_failed: cleanup failure after a detection
Fields it can set: win.defender.eventlog.threat_name, win.defender.eventlog.threat_path
av_tamper_blocked
Microsoft Defender tamper protection blocked a settings change.
Severity: Warning
Impact: A protection weakening attempt was blocked; repeated events may indicate a misapplied policy or hostile tampering.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 5013
Where to look next:
- Look for nearby configuration changes and policy refreshes.
- Treat repeated 5013 events differently from a one-time management action.
Related reasons:
av_config_changed: completed Defender configuration changeav_protection_disabled: protection actually disabled
av_threat_detected
Microsoft Defender detected malware or potentially unwanted software.
Severity: Error or Warning
Impact: A threat was present or suspected on the host; cleanup status depends on later remediation events.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1006, 1116
| Case | Severity | Ticket class |
|---|---|---|
high_severity | Error | endpoint_protection |
standard | Warning | endpoint_protection |
Where to look next:
- Pivot on Threat Name, Path, Process Name, Detection Source, and User.
- Pair with the later 1117, 1118, or 1119 outcome.
Related reasons:
av_threat_not_remediated: Defender allowed the threat instead of remediating itav_threat_remediated: Defender reports an action was takenav_threat_remediation_failed: Defender tried to remediate and failed
Fields it can set: win.defender.eventlog.category_id, win.defender.eventlog.category_name, win.defender.eventlog.detection_origin, win.defender.eventlog.detection_source, win.defender.eventlog.detection_type, win.defender.eventlog.severity_id, win.defender.eventlog.severity_name, win.defender.eventlog.threat_name, win.defender.eventlog.threat_path, win.defender.eventlog.user
av_threat_not_remediated
Microsoft Defender recorded a detection outcome where the item was allowed instead of remediated.
Severity: Serious
Impact: Potentially unwanted or malicious software may remain active or available on the host.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1007, 1117
Where to look next:
- Validate who or what policy allowed the item.
- Review Threat Name, Path, Process Name, User, and exclusion policy.
Related reasons:
av_threat_detected: detection that usually precedes the outcomeav_threat_remediated: same event family when Defender took a remediation actionav_threat_remediation_failed: attempted remediation failed instead of allowing the item
Fields it can set: win.defender.eventlog.action_id, win.defender.eventlog.action_name, win.defender.eventlog.status, win.defender.eventlog.threat_name, win.defender.eventlog.threat_path, win.defender.eventlog.user
av_threat_remediated
Microsoft Defender took a remediation action for a detected threat.
Severity: Warning
Impact: The host had a threat finding; Defender reports that it acted on the finding.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1007, 1117
Where to look next:
- Review Action Name and Error Code.
- Confirm whether the action cleaned, quarantined, removed, or allowed the item.
Related reasons:
av_threat_detected: detection that usually precedes the remediation recordav_threat_not_remediated: Allow action means no remediation was appliedav_threat_remediation_failed: remediation attempt failed
Fields it can set: win.defender.eventlog.action_id, win.defender.eventlog.action_name, win.defender.eventlog.status, win.defender.eventlog.threat_name, win.defender.eventlog.threat_path, win.defender.eventlog.user
av_threat_remediation_failed
Microsoft Defender tried to remediate a detected threat and failed.
Severity: Error
Impact: The detected threat may remain on disk or active because the cleanup action did not complete.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1008, 1118, 1119
Where to look next:
- Review Error Code and the affected Path.
- Run follow-up scan or manual cleanup if the threat is still present.
Related reasons:
av_threat_detected: detection that usually precedes the failureav_threat_not_remediated: item was allowed rather than remediatedav_threat_remediated: successful remediation outcome
Fields it can set: win.defender.eventlog.status, win.defender.eventlog.threat_name, win.defender.eventlog.threat_path
defender_asr_blocked
Microsoft Defender Attack Surface Reduction blocked an operation.
Severity: Warning
Impact: A configured ASR rule prevented behavior that policy considers risky or unwanted.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1121
Where to look next:
- Review rule ID, Path, and Process Name.
- Distinguish enforce-mode blocks from audit-mode would-block records.
Related reasons:
av_suspicious_behavior_detected: behavior-monitoring signal without an ASR rule blockdefender_network_protection_blocked: network protection block family
Fields it can set: win.defender.eventlog.rule_id, win.defender.eventlog.threat_path
defender_network_protection_blocked
Microsoft Defender Network Protection blocked a connection.
Severity: Warning
Impact: A configured protection policy prevented access to a network destination considered risky.
Channel: Microsoft-Windows-Windows Defender/Operational
Provider: Microsoft-Windows-Windows Defender
Event ids: 1126
Where to look next:
- Separate block-mode 1126 from audit-mode 1125.
- Review destination details when present in the rendered event.
Related reasons:
av_suspicious_behavior_detected: behavior monitoring found suspicious activitydefender_asr_blocked: another Defender policy-enforcement block
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.