By checking for where Windows Defender is disabled it allows one to determine if malicious activity is occurring.
|Last Reviewed Date||2021-11-12|
Thank you for submitting this idea! As part of an upcoming batch of Windows Server improvments, we will be looking to restructure the data that we pull in regarding Windows Defender. This will open the door for custom metrics and reports regarding the status of Windows Defender.