Windows 10: Using pwsQuery to retrieve Event Information for Windows Defender

Hi ,


I have a concern regarding the windows event viewer Microsoft-Windows-Windows Defender/Operational.

How to fetch the current signature version alone for the defender event id 2000 .


I have written a code below


LPWSTR pwsPath = L"Microsoft-Windows-Windows Defender/Operational";

//<xpath query goes here>

LPWSTR pwsQuery = L"*[System/EventID=2000]";
EVT_HANDLE hResults = NULL;
hResults = EvtQueryNULL, pwsPath, pwsQuery, EvtQueryChannelPath EvtQueryReverseDirection;
if NULL == hResults
{
EvtSeekhResults, 0, NULL, 0, EvtSeekRelativeToCurrent;
}


this will display all the details of eventid 2000 , I need only the current signature version of the latest event event id :2000


how to write the pwsQuery to obtain the required result


[Original Title: Windows Defender]

:)

 

windows defender event viewer

Hi ,

I have a concern regarding the windows event viewer (Microsoft-Windows-Windows Defender/Operational).

How to fetch the current signature version alone for the defender event id 2000 .

I have written a code below

LPWSTR pwsPath = L"Microsoft-Windows-Windows Defender/Operational";

//<xpath query goes here>

LPWSTR pwsQuery = L"*[System/EventID=2000]";

EVT_HANDLE hResults = NULL;

hResults = EvtQuery(NULL, pwsPath, pwsQuery, EvtQueryChannelPath | EvtQueryReverseDirection);

if (NULL == hResults)

{

EvtSeek(hResults, 0, NULL, 0, EvtSeekRelativeToCurrent);

}

this will display all the details of eventid 2000 , I need only the current signature version of the latest event (event id :2000)

how to write the pwsQuery to obtain the required result

 

windows defender - event log description

Hi ,

I have a concern regarding the windows event viewer (Microsoft-Windows-Windows Defender/Operational).

How to fetch the current signature version alone for the defender event id 2000 .

I have written a code below

LPWSTR pwsPath = L"Microsoft-Windows-Windows Defender/Operational";

//<xpath query goes here>

LPWSTR pwsQuery = L"*[System/EventID=2000]";

EVT_HANDLE hResults = NULL;

hResults = EvtQuery(NULL, pwsPath, pwsQuery, EvtQueryChannelPath | EvtQueryReverseDirection);

if (NULL == hResults)

{

EvtSeek(hResults, 0, NULL, 0, EvtSeekRelativeToCurrent);

}

this will display all the details of eventid 2000 , I need only the current signature version of the latest event (event id :2000)

how to write the pwsQuery to obtain the required result

 

windows defender

Hello,

Thank you for posting your query on Microsoft Community.

The information provided by you is not enough for us to provide you troubleshooting step. So, I would appreciate if you can provide us the following information to narrow down the issue.

• What issue you are facing with Windows Defender?
• Are you willing to update Windows Defender?

I would suggest you to refer the article mentioned below to ask question on the forum. After referring to the article do get back to us with more information related to your issue and we will be happy to assist you.

Suggestions for asking a question on help forums


Regards,