This scanner returns Windows Firewall Rule information. Requires Windows Server 2012/Windows 8 or higher.

Gathers basic Windows Defender Information such as product version and signature version using the built-in cmdlet Get-MpComputerStatus found in the defender module.

Gather active and past malware threats that Windows Defender detected in the system using the built-in cmdlet Get-MpThreatDetection found in the defender module. By default the Get-MpThreatDetection command will generate no output if there is no active or history of threats. This isn’t very helpful in generating reports since you’ll have no output to generate any reports. Once deployed, utilize an eicar text file to generate a false positive and base your reports on that output.