Microsoft Defender Compliance Pack (Win)
Description
This will be a guide to take FileWave usage one major step further than simply installing an application like Microsoft Defender. In this article you will see how to use Custom Fields, Smart Groups, Filesets, and Grafana to report on the status of your fleet. You can apply these ideas to other software solutions where you need to know if they are working, and to potentially fix them.
Ingredients
The Problem
You are managing hundreds or thousands of macOS or Windows devices, and need to understand if your environment is secure. Today you have been told to deploy Microsoft Defender and to provide reporting to your CISO demonstrating that you have Anti-Malware protection in place, and that it is operating correctly.
-
What kind of installers are used?
-
How can the install be performed silently? Fileset Magic needed?
-
What is the deadline to have the product deployed?
-
Will it replace another product?
-
MacOS, Windows or both?
Get started with this like any other deployment project:
-
Ask the vendor for installation documentation - but FileWave may also post some examples;
-
Create a reverse timeline. Start small.
-
Search the Internet for how others have reported on that product because FileWave can do anything scriptable.
Test and Verify:
- Test. Test. Verify and then test again.
- Deploy to 1 machine, then expand in growing waves so that you can stay ahead of issues.
- Do you have an Early Adopters group of users who give feedback and are forgiving?
Deployment
Installers on Windows are usually an EXE or an MSI. In this case a BAT file is provided by Microsoft because Defender is part of Windows.
Did you know that you can execute scripts in Filesets, and each kind runs in a specific order and time?
How could the Uninstallation Scripts be helpful? Think about later when you may want to remove the deployed software.
For the Deployment phase see this article on installation: Microsoft Defender Recipe (Win)
Reporting
Queries/Reports are an easy way to keep track of progress and problems. We’ve made some Custom Fields for Defender, and we can leverage them to show who is missing Defender.
FileWave also has installed application reporting but depending on your needs and how that application reports itself you can consider either method.
To use the custom fields you will want to download Defender Custom Fields.customfields and then add them to your server. Do this in FileWave Central -> Assistants -> Custom Fields -> Edit Custom Field Definitions. Click Import and choose the downloaded file. The definitions contain both macOS and Windows scripts and are configured for assignment to all devices. Before saving the newly imported fields, clear "Assigned to all Devices" for each field so that the pilot remains limited to the devices you select. If an Internal Name conflicts with an existing field, review the Custom Field import conflict options rather than overwriting a field already used by Reports or Smart Groups. Validate each platform's script output before broad assignment. For the pilot, assign the new fields only to a few devices. To do that go to FileWave Central -> Clients and right click on a device and pick Edit Custom Field Associations. There you can check the boxes to enable these new fields. When you are happy with these Custom Fields, you'll want to go back to Edit Custom Field Definitions and pick "Assigned to all Devices" for each of the fields.
Custom Fields based on scripts always need to be tested. Wait for the pilot clients to report inventory, then compare the collected values with the endpoint. These scripts end with exit 0 even when an earlier command may fail; an exit code alone is not proof that the value is complete or correct.
Now that you have your Custom Fields in place you should have some results. You can see them by going to Clients -> Customize Columns in the Toolbar, and then adding a couple of the custom fields to just see their values. You could also double click on any device in Clients that has the field active and see the values on the Device Details tab.
Let's move on to making a Query in Central. Click the New Query button in the Toolbar. Ignore the copies of the field below with a "2" as this is my lab. Notice that I used "Defender Healthy" as a Custom Field to test if Defender is healthy. I want to make sure that the field is populated so I check that it's not null, and I want to find unhealthy so I'm going to look for devices where it is false.
The pictured App Version filter finds devices with no reported Defender version; it does not prove Defender is absent. A field may be unassigned, waiting for client inventory, or unable to collect a value. Check the Custom Field assignment, recent client inventory, and the script result on the device before treating it as a missing installation. Track missing health values separately: the preceding "is not null" health filter excludes them, so an empty unhealthy report is not proof that every device is protected.
Remediation
Dashboards
There are two parts to creating a dashboard, getting the data to the dashboard (Prometheus), displaying the data in the way you want (Grafana).
Create the dashboard:
Copy and Paste the JSON into a New dashboard:
Dashboard JSON
{
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": {
"type": "grafana",
"uid": "-- Grafana --"
},
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"type": "dashboard"
}
]
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 0,
"id": 19,
"links": [],
"liveNow": false,
"panels": [
{
"collapsed": false,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 0
},
"id": 7,
"panels": [],
"title": "Overall Status",
"type": "row"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
}
},
"mappings": [],
"unitScale": true
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "{__name__=\"filewave_inventory_query_55\", genericclient_ptr__operating_system__type=\"OSX\", instance=\"localhost:20443\", job=\"extra-config-https\", query_name=\"overall_os_breakdown\"}"
},
"properties": [
{
"id": "displayName",
"value": "macOS"
},
{
"id": "color",
"value": {
"fixedColor": "blue",
"mode": "fixed"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "{__name__=\"filewave_inventory_query_55\", genericclient_ptr__operating_system__type=\"WIN\", instance=\"localhost:20443\", job=\"extra-config-https\", query_name=\"overall_os_breakdown\"}"
},
"properties": [
{
"id": "displayName",
"value": "Windows"
},
{
"id": "color",
"value": {
"fixedColor": "light-purple",
"mode": "fixed"
}
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 5,
"x": 0,
"y": 1
},
"id": 10,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/55/overview/"
}
],
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"pieType": "pie",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"tooltip": {
"mode": "single",
"sort": "none"
}
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_55",
"instant": true,
"legendFormat": "{{defender_healthy_fwcomp_pack}}",
"range": false,
"refId": "A"
}
],
"title": "Overall Desktop Device Breakdown",
"type": "piechart"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
}
},
"mappings": [],
"unitScale": true
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "{__name__=\"filewave_inventory_query_56\", genericclient_ptr__operating_system__type=\"OSX\", instance=\"localhost:20443\", job=\"extra-config-https\", query_name=\"devices_without_defender\"}"
},
"properties": [
{
"id": "displayName",
"value": "macOS"
}
]
},
{
"matcher": {
"id": "byName",
"options": "{__name__=\"filewave_inventory_query_56\", genericclient_ptr__operating_system__type=\"WIN\", instance=\"localhost:20443\", job=\"extra-config-https\", query_name=\"devices_without_defender\"}"
},
"properties": [
{
"id": "displayName",
"value": "Windows"
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 5,
"x": 5,
"y": 1
},
"id": 11,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/56/overview/"
}
],
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"pieType": "pie",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"tooltip": {
"mode": "single",
"sort": "none"
}
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_56",
"instant": true,
"legendFormat": "{{defender_healthy_fwcomp_pack}}",
"range": false,
"refId": "A"
}
],
"title": "Devices without Defender",
"type": "piechart"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "Relative health of Microsoft Defender",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
}
},
"mappings": [],
"unitScale": true
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "True"
},
"properties": [
{
"id": "color",
"value": {
"fixedColor": "green",
"mode": "fixed"
}
}
]
},
{
"matcher": {
"id": "byName",
"options": "False"
},
"properties": [
{
"id": "color",
"value": {
"fixedColor": "semi-dark-red",
"mode": "fixed"
}
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 5,
"x": 10,
"y": 1
},
"id": 1,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/49/overview/"
}
],
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"pieType": "pie",
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"tooltip": {
"mode": "single",
"sort": "none"
}
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_49{defender_healthy_fwcomp_pack=\"True\"}",
"instant": true,
"legendFormat": "{{defender_healthy_fwcomp_pack}}",
"range": false,
"refId": "A"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"expr": "filewave_inventory_query_49{defender_healthy_fwcomp_pack=\"False\"}",
"hide": false,
"legendFormat": "{{defender_healthy_fwcomp_pack}}",
"range": true,
"refId": "B"
}
],
"title": "Defender Healthy?",
"type": "piechart"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"custom": {
"align": "auto",
"cellOptions": {
"type": "auto"
},
"filterable": false,
"inspect": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unitScale": true
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "__name__"
},
"properties": [
{
"id": "custom.width",
"value": 290
},
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "Time"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "instance"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "query_name"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "Value"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "job"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
}
]
},
"gridPos": {
"h": 10,
"w": 4,
"x": 15,
"y": 1
},
"id": 2,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/50/overview/"
}
],
"options": {
"cellHeight": "sm",
"footer": {
"countRows": false,
"fields": "",
"reducer": [
"sum"
],
"show": false
},
"showHeader": true,
"sortBy": [
{
"desc": false,
"displayName": "device_name"
}
]
},
"pluginVersion": "10.3.1",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_50",
"format": "table",
"instant": true,
"legendFormat": "{{device_name}}",
"range": false,
"refId": "A"
}
],
"title": "Unhealthy Defender Clients",
"transformations": [],
"type": "table"
},
{
"collapsed": false,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 11
},
"id": 12,
"panels": [],
"title": "Threat Detection and Issues",
"type": "row"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "thresholds"
},
"custom": {
"align": "auto",
"cellOptions": {
"type": "auto"
},
"inspect": false
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unitScale": true
},
"overrides": [
{
"matcher": {
"id": "byName",
"options": "Time"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "Value"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "query_name"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "job"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "device_name"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "__name__"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "instance"
},
"properties": [
{
"id": "custom.hidden",
"value": true
}
]
},
{
"matcher": {
"id": "byName",
"options": "defender_threats_detected_fwcomp_pack"
},
"properties": [
{
"id": "displayName",
"value": "Threat Detected"
}
]
}
]
},
"gridPos": {
"h": 9,
"w": 19,
"x": 0,
"y": 12
},
"id": 13,
"links": [
{
"targetBlank": true,
"title": "Show Details",
"url": "https://support2.filewave.net/filewave/reports/57/overview/"
}
],
"options": {
"cellHeight": "sm",
"footer": {
"countRows": false,
"fields": "",
"reducer": [
"sum"
],
"show": false
},
"showHeader": true
},
"pluginVersion": "10.3.1",
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_57",
"format": "table",
"instant": true,
"legendFormat": "{{label_name}}",
"range": false,
"refId": "A"
}
],
"title": "Detected Threats",
"type": "table"
},
{
"collapsed": false,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 21
},
"id": 6,
"panels": [],
"title": "Windows",
"type": "row"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"fillOpacity": 80,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineWidth": 1,
"scaleDistribution": {
"type": "linear"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unitScale": true
},
"overrides": []
},
"gridPos": {
"h": 10,
"w": 8,
"x": 0,
"y": 22
},
"id": 4,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/52/overview/"
}
],
"options": {
"barRadius": 0,
"barWidth": 0.97,
"fullHighlight": false,
"groupWidth": 0.7,
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom",
"showLegend": false
},
"orientation": "auto",
"showValue": "auto",
"stacking": "none",
"tooltip": {
"mode": "single",
"sort": "none"
},
"xTickLabelRotation": 0,
"xTickLabelSpacing": 0
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_52",
"instant": true,
"legendFormat": "{{defender_defs_version_fwcomp_pack}}",
"range": false,
"refId": "A"
}
],
"title": "Virus Defs Versions Windows",
"type": "barchart"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"fillOpacity": 80,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineWidth": 1,
"scaleDistribution": {
"type": "linear"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unitScale": true
},
"overrides": []
},
"gridPos": {
"h": 10,
"w": 9,
"x": 8,
"y": 22
},
"id": 9,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/54/overview/"
}
],
"options": {
"barRadius": 0,
"barWidth": 0.97,
"fullHighlight": false,
"groupWidth": 0.7,
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom",
"showLegend": false
},
"orientation": "auto",
"showValue": "auto",
"stacking": "none",
"tooltip": {
"mode": "single",
"sort": "none"
},
"xTickLabelRotation": 0,
"xTickLabelSpacing": 0
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_54",
"instant": true,
"legendFormat": "{{defender_app_version_fwcomp_pack}}",
"range": false,
"refId": "A"
}
],
"title": "Defender Version Windows",
"type": "barchart"
},
{
"collapsed": false,
"gridPos": {
"h": 1,
"w": 24,
"x": 0,
"y": 32
},
"id": 5,
"panels": [],
"title": "macOS",
"type": "row"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"fillOpacity": 80,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineWidth": 1,
"scaleDistribution": {
"type": "linear"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unitScale": true
},
"overrides": []
},
"gridPos": {
"h": 10,
"w": 8,
"x": 0,
"y": 33
},
"id": 3,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/51/overview/"
}
],
"options": {
"barRadius": 0,
"barWidth": 0.97,
"fullHighlight": false,
"groupWidth": 0.7,
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom",
"showLegend": false
},
"orientation": "auto",
"showValue": "auto",
"stacking": "none",
"tooltip": {
"mode": "single",
"sort": "none"
},
"xTickLabelRotation": 0,
"xTickLabelSpacing": 0
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_51",
"instant": true,
"legendFormat": "{{defender_defs_version_fwcomp_pack}}",
"range": false,
"refId": "A"
}
],
"title": "Virus Defs Versions macOS",
"type": "barchart"
},
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"description": "",
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisBorderShow": false,
"axisCenteredZero": false,
"axisColorMode": "text",
"axisLabel": "",
"axisPlacement": "auto",
"fillOpacity": 80,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineWidth": 1,
"scaleDistribution": {
"type": "linear"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"unitScale": true
},
"overrides": []
},
"gridPos": {
"h": 10,
"w": 9,
"x": 8,
"y": 33
},
"id": 8,
"links": [
{
"targetBlank": true,
"title": "",
"url": "https://support2.filewave.net/filewave/reports/53/overview/"
}
],
"options": {
"barRadius": 0,
"barWidth": 0.97,
"fullHighlight": false,
"groupWidth": 0.7,
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom",
"showLegend": false
},
"orientation": "auto",
"showValue": "auto",
"stacking": "none",
"tooltip": {
"mode": "single",
"sort": "none"
},
"xTickLabelRotation": 0,
"xTickLabelSpacing": 0
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "filewave_prometheus"
},
"editorMode": "builder",
"exemplar": false,
"expr": "filewave_inventory_query_53",
"instant": true,
"legendFormat": "{{defender_app_version_fwcomp_pack}}",
"range": false,
"refId": "A"
}
],
"title": "Defender Version macOS",
"type": "barchart"
}
],
"refresh": "",
"schemaVersion": 39,
"tags": [],
"templating": {
"list": []
},
"time": {
"from": "now-6h",
"to": "now"
},
"timepicker": {},
"timezone": "",
"title": "Defender Dashboard",
"uid": "c26006b5-0295-4ec0-9b54-3efd3d714a9f",
"version": 1,
"weekStart": ""
}
No comments to display
No comments to display