Defender Status Reporting

In this post I am going to explain what I’ve done to report on the status of Microsoft Defender on cluster nodes.

Why?

The reason I spent time on this, is that I couldn’t find an easy way to see if (and check that) Defender was running and being updated regularly. I don’t use SCCM or Intune, Azure Security Center doesn’t appear to have these details (and can be expensive) and so PowerShell was the best option, for me.

Approach

1. Create PowerShell script to get details from servers
2. Find visualisation tool to view status details
3. Automate running of script and getting details to visualisation tool

PowerShell Script

For the script, I needed it to be able to run remotely as eventually it would be running from a central location and connect remotely to multiple clusters and nodes.

The script uses the ‘Get-MpComputerStatus’ cmdlet that provides the details for Defender and employs the -CimSession method of connecting to servers. An ordered Hash Table is created containing all the details needed and then the output can be controlled as per requirements, e.g. a table in the PowerShell console or outputted to CSV and html files, (my plan is to output to a csv and ingest that file into a database).

Script can be found here: https://github.com/hciharrison/scripts/blob/master/powershell/Get-DefenderDetails.ps1

To have the script output the details to a csv or html file, you can use the below syntax at the end of the script:

$datetime = (get-date -f yyyy-MM-dd-HHmm)

$Header = @"
<style>
TABLE {border-width: 1px; border-style: solid; border-color: black; border-collapse: collapse;}
TH {border-width: 1px; padding: 3px; border-style: solid; border-color: black; background-color: #6495ED;}
TD {border-width: 1px; padding: 3px; border-style: solid; border-color: black;}
</style>
"@

Get-DefenderDetails | ConvertTo-Html -Head $Header | Out-File -FilePath defender_details_report_$datetime.html -NoClobber
Get-DefednerDetails | Export-Csv -NoTypeInformation defender_details_report_$datetime.csv