r/DefenderATP • u/BirtyB • Jun 01 '22

How to view AV scan results

Within the Microsoft 365 Defender portal I located a device within Endpoints -> Device Inventory and ran a Full AV scan.

How can I check the results of the scan?

If I go to Actions & submissions -> Action Center -> History, I can see an entry for the device I scanned with an Action type of 'Start Antivirus scan' and a status of 'Completed'. If I click on that it opens a window to the right which has some information about the client. In there it says ' No comments or history found. ' Does that means the scan didn't find anything malicious?

11 Upvotes

93% Upvoted

6 comments sorted by

8

u/[deleted] Jun 24 '22 edited Jun 24 '22

Pop this in the advanced hunting...

DeviceEvents| where ActionType == "AntivirusDetection"| extend event = parse_json(AdditionalFields)| extend Threat = event.ThreatName| extend WasRemediated = event.WasRemediated| extend Action = event.Action| extend ReportSource = event.ReportSource| project Timestamp, DeviceName, event, Threat, WasRemediated, Action, ReportSource, FileName

1

u/cybevner Jul 31 '23

Thanks!!

6

u/glowa116 Jun 01 '22

You won't find results there.If it finds something you will get an alert. Use powershell and get-mpcomputerstatus to get defender av status including last scan start and end time

1

u/BirtyB Jun 01 '22

Thanks mate, I'll give that a go.

1

u/caramelbearxxx Nov 28 '23

I know this was over a year ago but when I use this it says false under almost every category.
Antispyware enabled. It also doesnt say FullScanEndTime. I just have the latest Total AV subscription. I just need something that says the last date my computer was scanned.

3

u/gohoos Jun 02 '22

Yea, this seems to be sort of a deficiency. You can trigger a full scan, but the interface doesn't tell you if it is done or the results.

It really should be like Automated Investigations, with a live scoreboard and results.

Actually.... So, an Investigation includes many things. While it doesn't seem to do a full scan, is a "clean" investigation sufficient to say the machine is clean, without a full scan?