Antivirus Scan Completed
This rule detects when an antivirus scan has completed on a device. It extracts the scan type from the additional fields and summarizes the count of completed scans by timestamp, device name, action type, and scan type. This rule can be used to monitor the frequency and types of antivirus scans occurring across an environment.
Microsoft Sentinel (KQL)
