A Defender event establishes that the product recorded a particular observation or state transition. It does not independently prove that malicious code executed, that remediation finished successfully, or that a named user deliberately introduced the object. Begin with the record's event type and original fields, then connect them to a specific evidence question.
Identify the actual product and channel
Record Windows build, Defender platform and engine versions, security-intelligence version where available, relevant protection state, native channel, collector, and collection interval. Microsoft Defender Antivirus endpoint logs, Defender for Endpoint portal records, and a generated diagnostic package are distinct sources. Similar threat names across them do not establish identical retained detail or time coverage.
The existing Windows Defender Logs page is the curated field-manual entry point. Use Microsoft’s event-ID and error-code reference for producer semantics, checking applicability against the event and platform version. A long-lived documentation page can include older event families and historical products alongside current descriptions.
Separate a detection from the action taken
Microsoft documents Event 1116 as a detection record and 1117 as an action record. Read the actual action, status, and error fields rather than assuming the second means successful removal. An allowed action can leave a detected item unremediated. A threat label is a product classification at that time; it does not automatically establish an object's complete behavior or origin.
| Observation | Question still to answer |
|---|---|
| A detection event | What object or behavior was identified, by which version and source? |
| An action event | Which action and result were recorded, including failures? |
| A configuration event | What changed, and what independent evidence explains the change? |
| No matching retained event | Was the relevant coverage active, retained, collected, and searched? |
Preserve evidence before flattening it into an alert table
Where available within scope, retain native event material and the acquisition log, then create a documented working export. Preserve event IDs, provider, record identifier, raw time, relevant paths and identifiers, detection context, action result, and version information. A screenshot can omit fields or surrounding events needed to distinguish repeated detections from one incident.
Keep source and collector times separate. A central alert's creation time can differ from the endpoint event time. Record any filters, selected devices, account permissions, pagination, and export limits applied by the collection interface. The absence of a portal result does not establish absence from the endpoint channel.
Do not treat diagnostic collection as a complete image
Microsoft’s diagnostic-data collection guide describes a generated support package for troubleshooting and distinguishes it from an Endpoint investigation package. Record package creation time, producing device, original filename, hash, and documented scope. A support archive can aid interpretation without preserving every source artifact or the earlier state of a live device.
If collection itself generates files or product activity, document that change. Preserve package identifiers per device to avoid confusing archives with common filenames. Keep extracted contents related to their parent archive and retain the original archive independently from analysis output.
Compare the event with evidence of the underlying activity
For a file-related detection, examine the preserved object or another supported identifier where available. For a proposed execution, seek independent process or application evidence. For an alleged deliberate configuration change, compare authorized administration and surrounding system records. Routine updates, policy application, and product operations are alternatives to evaluate, not explanations to assume.
A bounded report can state that a specific engine recorded a detection and an action result while leaving execution or human attribution unresolved. Conversely, no detection does not prove a clean system: it may reflect protection state, unsupported behavior, retention, collection, or a method limitation.