1
Added the following event logs to the monitoring rules capability: Microsoft-Windows-Windows Defender/Operational Useful to log/email malware detection events, e.g. Event ID’s 1116 (malware/pup detection) and 1117 (malware remediation/quarantine/removal) Microsoft-Windows-Windows Firewall With Advanced Security/Firewall Useful to log/email intrusion detection events or problems with software not bypassing the firewall. Microsoft-Windows-WindowsUpdateClient/Operational Useful to log/email Windows Update errors. Additional custom logs can be added upon request, but the logs added (above) are by far the most useful outside...