AV Defender Security Event service

The AV Defender Security Event service reports on security events when they are detected on a device that has AV Defender installed. The service applies to both the Managed AV Defender Security Event and the Unmanaged AV Defender Security Event.

The retention of the Security Event Data is 90 days (no setting to change this value).

This service cannot use Self Healing.

Configure this service by selecting the detection types that AV Defender are reporting on, then choose the actions to take on detected security threats.

Configure the AV Defender Event service

1. Click View > All Devices in the navigation pane.
2. In the Name column, click the device that you want to edit a service.
3. Click the Monitor > Status tabs.
4. In the Service column, click the AV Defender Security Event service.
5. Click the Service Details tab.
6. Under Malware Detection Type, select the detection types in the left-hand column that you want to monitor.
7. Click > to move the type to the right-hand column.
8. Under Monitoring Actions, select the actions and status you want returned by the AV Defender Security Event service based on the column where the action is listed as:
   • To return a Normal status, click Move to Normal
   • To return a Warning status, click Move to Warning
   • To return a Failed status, click Move to Failed
9. Click OK.

Most detected phishing events correspond to items that have been handled by the client. Any that get through are part of an email archive, or because a reboot is required. In both cases, the malware has been contained, so there's no reason for alarm. If an alarm keeps reappearing, there may be something that the client has not yet detected.

Notification numeric values

Notifications for the AV Defender Security Event service use numeric values to report different elements of security events with the values mapped as follows by default: