Windows Security Product Disabled or Snoozed
Detects when a registered security product on a Windows system has been turned off or snoozed, indicated by Windows Security Center Event ID 15 with specific states.
Microsoft Sentinel (KQL)
Detects when a registered security product on a Windows system has been turned off or snoozed, indicated by Windows Security Center Event ID 15 with specific states.
Already have an account?