Checking Windows defender turned off

[Qusai_Ismail]

Hello,

Is there a logs can get from sentinel to check if windows defender is turned off in one endpoint.

Thanks.

[#2]

Maybe something like this (there are other examples): https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/Microsoft%20365%20Defender/Gen...

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/check-sensor-status?view=o...