AzStackHci.EnvironmentChecker

1.2100.2685.475

Obs/bin/GMA/Monitoring/Agent/initconfig/2.0/Standard/AzSecMdsAntimalwareOffline-Content.xml

                                <?xml version="1.0" encoding="utf-8"?>

<MonitoringManagement version="1.0" timestamp="2023-06-08T00:58:42.4731192Z">

  <!-- Autogenerated version comment - DO NOT REMOVE: AzSecPackShipVersion=4.27.0.4 -->

  <Events>

    <!-- 

              Diagnostic Tool File Monitor. 

              When the doagnostic tool is run it places all the MEPSupport cab files

              under %Program Data%\Microsoft\Microsoft Antimalware\Support\*.cab, this file Monitor will upload 

                                                  data to the corresponding storage account as soon as it detects

                                                  any activity under this dir.

              -->

    <FileMonitors storeType="CentralBond">

      <FileWatchItem eventName="AsmSysAvFMEvent" filter=".*\.cab" container="azsecsysavfm" contextParam="MalwareEngineLogs" directoryQuotaInMB="100" lastChangeOffsetInSeconds="60" uploadDelayInSeconds="60" removeEmptyDirectories="false" retentionInDays="30" account="AzSecurityStore">

        <Directory><![CDATA[Concat("", GetEnvironmentVariable("ProgramData"), "\Microsoft\Microsoft Antimalware\Support")]]></Directory>

      </FileWatchItem>

      <FileWatchItem eventName="AsmSysAvFMEvent" container="azsecsysavfm" compressionType="gzip" contextParam="QuarantineFiles" directoryQuotaInMB="100" lastChangeOffsetInSeconds="60" uploadDelayInSeconds="60" removeEmptyDirectories="false" retentionInDays="30" account="AzSecurityStore">

        <Directory><![CDATA[Concat("", GetEnvironmentVariable("ProgramData"), "\Microsoft\Microsoft Antimalware\Quarantine")]]></Directory>

      </FileWatchItem>

      <FileWatchItem eventName="AsmSysAvFMEvent" filter=".*\.cab" container="azsecsysavfm" contextParam="MalwareEngineLogs" directoryQuotaInMB="100" lastChangeOffsetInSeconds="60" uploadDelayInSeconds="60" removeEmptyDirectories="false" retentionInDays="30" account="AzSecurityStore">

        <Directory><![CDATA[Concat("", GetEnvironmentVariable("ProgramData"), "\Microsoft\Windows Defender\Support")]]></Directory>

      </FileWatchItem>

      <FileWatchItem eventName="AsmSysAvFMEvent" container="azsecsysavfm" compressionType="gzip" contextParam="QuarantineFiles" directoryQuotaInMB="100" lastChangeOffsetInSeconds="60" uploadDelayInSeconds="60" removeEmptyDirectories="false" retentionInDays="30" account="AzSecurityStore">

        <Directory><![CDATA[Concat("", GetEnvironmentVariable("ProgramData"), "\Microsoft\Windows Defender\Quarantine")]]></Directory>

      </FileWatchItem>

    </FileMonitors>

    <WindowsEventLogSubscriptions>

      <!-- Captures all Microsoft Antimalware Events -->

      <Subscription eventName="AsmSysMepLocal" query="System!*[System[Provider[@Name='Microsoft Antimalware'] and (EventID != 5007)]]" storeType="Local">

        <Column name="EventProvider" defaultAssignment="">

          <Value>/Event/System/Provider/@Name</Value>

        </Column>

        <Column name="EventType" defaultAssignment="0">

          <Value>/Event/System/EventID</Value>

        </Column>

        <Column name="TimeCreated" defaultAssignment="">

          <Value>/Event/System/TimeCreated/@SystemTime</Value>

        </Column>

        <Column name="EventPayload" defaultAssignment="">

          <Value>/Event/EventData/Data</Value>

        </Column>

        <Column name="EventDescription">

          <Value>GetEventMetadata("Description")</Value>

        </Column>

      </Subscription>

      <!-- Captures all Windows Defender Events -->

      <Subscription eventName="AsmSysMepLocal" query="Microsoft-Windows-Windows Defender/Operational!*[System[(EventID != 5007)]]" storeType="Local">

        <Column name="EventProvider" defaultAssignment="">

          <Value>/Event/System/Provider/@Name</Value>

        </Column>

        <Column name="EventType" defaultAssignment="0">

          <Value>/Event/System/EventID</Value>

        </Column>

        <Column name="TimeCreated" defaultAssignment="">

          <Value>/Event/System/TimeCreated/@SystemTime</Value>

        </Column>

        <Column name="EventPayload" defaultAssignment="">

          <Value>/Event/EventData/Data</Value>

        </Column>

        <Column name="EventDescription">

          <Value>GetEventMetadata("Description")</Value>

        </Column>

      </Subscription>

    </WindowsEventLogSubscriptions>

    <DerivedEvents>

      <DerivedEvent source="AsmSysMepLocal" eventName="AsmSysAV" storeType="CentralBond" duration="PT5M" account="AzSecurityStore" retentionInDays="90">

        <Query><![CDATA[

            let ReportingIdentity=GetStaticEnvironmentVariable("MA_HEARTBEAT_IDENTITY")          

            let AssetIdentity=GetStaticEnvironmentVariable("MA_AZURE_IDENTITY")

            let CRPVMId=GetStaticEnvironmentVariable("MA_RoleEnvironment_VmId")

            let ServiceId=GetStaticEnvironmentVariable("SERVICE_TREE_ID")

            let SubscriptionId=GetStaticEnvironmentVariable("MA_RoleEnvironment_SubscriptionId")

            let ComputerName=GetStaticEnvironmentVariable("MA_COMPUTERNAME_FQDN") == "" ? GetStaticEnvironmentVariable("COMPUTERNAME") : GetStaticEnvironmentVariable("MA_COMPUTERNAME_FQDN")

            select ReportingIdentity, AssetIdentity, EventProvider, EventType, EventDescription, TimeCreated, EventPayload, CRPVMId, ServiceId, SubscriptionId, ComputerName

                    ]]></Query>

      </DerivedEvent>

    </DerivedEvents>

  </Events>

</MonitoringManagement>