# Microsoft Defender & AV Logs

> Master Microsoft Defender Antivirus logging. Explore Defender architecture, Attack Surface Reduction (ASR) rules, and how to analyze operational event IDs to detect and block malware.

Canonical: https://codelivly.com/rooms/microsoft-defender-av-logs
Last updated: 2026-07-02

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 200 |

Dive into the built-in endpoint protection of Windows. The Microsoft Defender & AV Logs module breaks down how Microsoft Defender Antivirus operates, detects threats, and logs its activity.

You will explore the architecture of Defender, understand how Attack Surface Reduction (ASR) rules block malicious behaviors at the kernel and user levels, and learn how to parse Microsoft Defender operational event IDs to track malware executions, quarantine actions, and blocked exploits. By the end of this module, you will know how to leverage native AV logs for incident response and threat hunting.

## Lessons

1. Microsoft Defender Architecture & Components (30 min)
2. Attack Surface Reduction (30 min)
3. Analyzing Microsoft Defender Event IDs & Oper (30 min)

## Related

- [Learning path: Windows Fundamentals](https://codelivly.com/learning-paths/windows-fundamentals)
- [All rooms](https://codelivly.com/rooms)