Latest Antivirus Scan Status

# Latest Antivirus Scan Status

## Query Information

#### Description
This query lists the latest completed antivirus scan for each device. The query filters all devices that have performed a successful scan today. 

#### Risk
The Defender sensor is not working corretly and might not be able to idenfity suspicious behaviour.

#### References
- https://cloudbrothers.info/antivirus-scan-complete/

## Defender XDR
```KQL
DeviceEvents
| where ActionType == "AntivirusScanCompleted"
| summarize arg_max(Timestamp, *) by DeviceId
| extend ScanType = tostring(parse_json(AdditionalFields).ScanTypeIndex), 
    DaysAgo = datetime_diff('day', now(), Timestamp)
| project DeviceName, ActionType, ScanType, DaysAgo
// Filter only devices that have not performed a antivirus scan in the last day
| where DaysAgo > 0
| sort by DaysAgo
```
## Sentinel
```KQL
DeviceEvents
| where ActionType == "AntivirusScanCompleted"
| summarize arg_max(TimeGenerated, *) by DeviceId
| extend ScanType = tostring(parse_json(AdditionalFields).ScanTypeIndex), 
    DaysAgo = datetime_diff('day', now(), Timestamp)
| project DeviceName, ActionType, ScanType, DaysAgo
// Filter only devices that have not performed a antivirus scan in the last day
| where DaysAgo > 0
| sort by DaysAgo
```