Added new Windows Defender policy & configuration profile (#32956)

- Added new Windows Defender policy that checks to make sure Windows Defender is running, antivirus is enabled, real-time protect is enabled, and data protection access is enabled.
- Added additional formatting to policies section

it-and-security/lib/windows/configuration-profiles/Windows Defender compliance settings.xml

@@ -0,0 +1,69 @@
+<!-- Enable Real-Time Protection -->
+<Replace>
+  <CmdID>1</CmdID>
+  <Item>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/Defender/AllowRealtimeMonitoring</LocURI>
+    </Target>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Data>1</Data>
+  </Item>
+</Replace>
+
+<!-- Enable Cloud Protection (MAPS) -->
+<Replace>
+  <CmdID>2</CmdID>
+  <Item>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/Defender/AllowCloudProtection</LocURI>
+    </Target>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Data>1</Data>
+  </Item>
+</Replace>
+
+<!-- Enable Behavior Monitoring -->
+<Replace>
+  <CmdID>3</CmdID>
+  <Item>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/Defender/AllowBehaviorMonitoring</LocURI>
+    </Target>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Data>1</Data>
+  </Item>
+</Replace>
+
+<!-- Enable Script Scanning -->
+<Replace>
+  <CmdID>4</CmdID>
+  <Item>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/Defender/AllowScriptScanning</LocURI>
+    </Target>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Data>1</Data>
+  </Item>
+</Replace>
+
+<!-- Configure Sample Submission -->
+<Replace>
+  <CmdID>5</CmdID>
+  <Item>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/Defender/SubmitSamplesConsent</LocURI>
+    </Target>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Data>1</Data>
+  </Item>
+</Replace>

it-and-security/lib/windows/policies/windows-defender-compliance-check.yml

@@ -0,0 +1,66 @@
+- name: Windows - Windows Defender compliance check
+  query: |
+    WITH defender_service AS (
+        SELECT 
+            CASE 
+                WHEN COUNT(CASE WHEN name = 'IsServiceRunning' AND data = 1 THEN 1 END) > 0 THEN 1
+                ELSE 0
+            END as service_running
+        FROM registry 
+        WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender'
+    ),
+    defender_realtime AS (
+        SELECT 
+            CASE 
+                WHEN COUNT(CASE WHEN name = 'DisableRealtimeMonitoring' THEN 1 END) = 0 THEN 1
+                WHEN MAX(CASE WHEN name = 'DisableRealtimeMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1
+                ELSE 0
+            END as realtime_enabled
+        FROM registry 
+        WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
+    ),
+    defender_behavior AS (
+        SELECT 
+            CASE 
+                WHEN COUNT(CASE WHEN name = 'DisableBehaviorMonitoring' THEN 1 END) = 0 THEN 1
+                WHEN MAX(CASE WHEN name = 'DisableBehaviorMonitoring' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1
+                ELSE 0
+            END as behavior_enabled
+        FROM registry 
+        WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
+    ),
+    defender_cloud AS (
+        SELECT 
+            CASE 
+                WHEN COUNT(CASE WHEN name = 'SpyNetReporting' THEN 1 END) = 0 THEN 1
+                WHEN MAX(CASE WHEN name = 'SpyNetReporting' AND data > 0 THEN 1 ELSE 0 END) = 1 THEN 1
+                ELSE 0
+            END as cloud_enabled
+        FROM registry 
+        WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet'
+    ),
+    defender_script AS (
+        SELECT 
+            CASE 
+                WHEN COUNT(CASE WHEN name = 'DisableScriptScanning' THEN 1 END) = 0 THEN 1
+                WHEN MAX(CASE WHEN name = 'DisableScriptScanning' AND data = 0 THEN 1 ELSE 0 END) = 1 THEN 1
+                ELSE 0
+            END as script_enabled
+        FROM registry 
+        WHERE key = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
+    )
+    SELECT 
+        CASE 
+            WHEN (SELECT service_running FROM defender_service) = 1 
+             AND (SELECT realtime_enabled FROM defender_realtime) = 1 
+             AND (SELECT behavior_enabled FROM defender_behavior) = 1 
+             AND (SELECT cloud_enabled FROM defender_cloud) = 1 
+             AND (SELECT script_enabled FROM defender_script) = 1 
+            THEN 1
+            ELSE 0
+        END as policy_compliance;
+
+  critical: true
+  description: "Failing this policy indicates that Windows Defender service is not running, or one or more of the following features are disabled: real-time protection, behavior monitoring, cloud protection (MAPS), or script scanning. This could leave your device vulnerable to malware, spyware, and other security threats."
+  resolution: "Corrective actions include ensuring the Windows Defender service is running and that real-time protection, behavior monitoring, cloud protection, and script scanning are all enabled. Check that the MDM configuration profile has been applied successfully. If these actions are not successful, try rebooting before sending a message to #help-dogfooding in Slack."
+  platform: windows

it-and-security/teams/workstations-canary.yml

@@ -138,6 +138,7 @@ controls:
       - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml
       - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml
       - path: ../lib/windows/configuration-profiles/Disable Guest account.xml
+      - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2
@@ -164,6 +165,7 @@ controls:
     - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
     - path: ../lib/macos/scripts/install-nudge.sh
 policies:
+  # macOS policies
   - path: ../lib/macos/policies/1password-emergency-kit-check.yml
   - path: ../lib/macos/policies/update-firefox.yml
   - path: ../lib/macos/policies/update-slack.yml
@@ -178,11 +180,14 @@ policies:
   - path: ../lib/macos/policies/company-portal-installed.yml
   - path: ../lib/macos/policies/entra-conditional-access-check.yml
   - path: ../lib/macos/policies/install-nudge.yml
+  # Windows policies
   - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
   - path: ../lib/windows/policies/all-windows-updates-installed.yml
   - path: ../lib/windows/policies/disk-encryption-check.yml
   - path: ../lib/windows/policies/1password-installed.yml
   - path: ../lib/windows/policies/update-1password.yml
+  - path: ../lib/windows/policies/windows-defender-compliance-check.yml
+  # Linux policies
   - path: ../lib/linux/policies/disk-encryption-check.yml
   - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
 queries:

it-and-security/teams/workstations.yml

@@ -91,6 +91,7 @@ controls:
       - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml
       - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml
       - path: ../lib/windows/configuration-profiles/Disable Guest account.xml
+      - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2
@@ -109,6 +110,7 @@ controls:
     - path: ../lib/macos/scripts/install-nudge.sh
     - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
 policies:
+  # macOS policies
   - path: ../lib/macos/policies/1password-emergency-kit-check.yml
   - path: ../lib/macos/policies/update-firefox.yml
   - path: ../lib/macos/policies/latest-macos.yml
@@ -118,13 +120,16 @@ policies:
   - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml
   - path: ../lib/macos/policies/disk-encryption-check.yml
   - path: ../lib/macos/policies/1password-installed.yml
+  - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
   - path: ../lib/macos/policies/install-nudge.yml
+  # Windows policies
   - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
   - path: ../lib/windows/policies/all-windows-updates-installed.yml
   - path: ../lib/windows/policies/disk-encryption-check.yml
   - path: ../lib/windows/policies/1password-installed.yml
   - path: ../lib/windows/policies/update-1password.yml
-  - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
+  - path: ../lib/windows/policies/windows-defender-compliance-check.yml
+  # Linux policies
   - path: ../lib/linux/policies/disk-encryption-check.yml
   - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
 queries: