Microsoft Security Essentials - Scan stopped before completion.

Description

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 18100 Group of windows rules. anchor level 0
   Matches no fields of its own.
2. 7701 Microsoft Antimalware informational event anchor level 0
   Matches no fields of its own.
3. 7704 Grouping of Microsoft Security Essentials rules. anchor level 0
   Matches no fields of its own.
4. 7717 Microsoft Security Essentials - Scan stopped before completion. refinement level 5 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 7704
  • Grouping of Microsoft Security Essentials rules.

Rule logic