From 01fa5b3afd01474de0d5a9f38b16ac3ed1555a7a Mon Sep 17 00:00:00 2001
From: michelletandya <michelletandya@google.com>
Date: Mon, 10 May 2021 23:17:08 +0000
Subject: [PATCH] Add windows defender problem detection custom plugin

---
 config/plugin/windows_defender_problem.ps1 | 10 ++++++++++
 config/windows-defender-monitor.json       | 21 +++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 config/plugin/windows_defender_problem.ps1
 create mode 100644 config/windows-defender-monitor.json

diff --git a/config/plugin/windows_defender_problem.ps1 b/config/plugin/windows_defender_problem.ps1
new file mode 100644
index 00000000..d2d0f4a3
--- /dev/null
+++ b/config/plugin/windows_defender_problem.ps1
@@ -0,0 +1,10 @@
+# This plugin checks to see if windows defender detects any threats to the node.
+
+$windowsDefenderThreats = (Get-MpThreat | Where-Object {$_.IsActive -or $_.DidThreatExecute})
+
+if ($windowsDefenderThreats.length -ne 0) {
+    Write-Host $windowsDefenderThreats
+    exit 1
+} else {
+    exit 0
+}
diff --git a/config/windows-defender-monitor.json b/config/windows-defender-monitor.json
new file mode 100644
index 00000000..2c46b8c6
--- /dev/null
+++ b/config/windows-defender-monitor.json
@@ -0,0 +1,21 @@
+{
+    "plugin": "custom",
+    "pluginConfig": {
+      "invoke_interval": "10m",
+      "timeout": "5s",
+      "max_output_length": 80,
+      "concurrency": 3
+    },
+    "source": "windows-defender-custom-plugin-monitor",
+    "metricsReporting": true,
+    "conditions": [],
+    "rules": [
+      {
+        "type": "temporary",
+        "reason": "WindowsDefenderThreatsDetected",
+        "path": "./config/plugin/windows_defender_problem.ps1",
+        "timeout": "3s"
+      }
+    ]
+  }
+  
\ No newline at end of file