Skip to main content
Version: 2.1.1-preview

MT.1168 - Cleaned Malware should be retained for at least 30 days

Overview​

Verify that cleaned malware is retained for at least 30 days to support forensic analysis and threat investigation.

Short retention may impact forensic analysis and threat investigation.

Remediation action:​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Set Days to Retain Cleaned Malware to at least 30 days (recommended: 90 days)

Test Metadata​

FieldValue
Test IDMT.1168
SeverityHigh
SuiteM365 Advisor
CategoryDefender
PowerShell testTest-MtMdeRetainCleanedMalware
TagsDefender, M365Advisor, MT.1168

Remediation​

  1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
  2. Edit the relevant Microsoft Defender Antivirus policy
  3. Set Days to Retain Cleaned Malware to at least 30 days (recommended: 90 days)

Source​

  • Pester test: tests/M365Advisor/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
  • PowerShell source: powershell/public/M365Advisor/defender/Test-MtMdeRetainCleanedMalware.ps1