Description: This query leverages the new feature in Audit and Remediation to be able to query the Windows event log. The query specifically displays the latest CB Standard (formally CB Defense) background scan status. The background scan status event is sent to the Windows event viewer every time the system reboots.
What The Data Shows: Shows the latest background scan status (in progress, complete, disabled) as well as the date and time that the scan event was registered.
WHEN data like "%IN_PROGRESS%" then "IN PROGRESS"
WHEN data like "%COMPLETE%" then "COMPLETE"
WHEN data like "%DISABLED%" then "DISABLED"
END "Background Scan Status"
, MAX(DATETIME(datetime)) AS "Scan Status Update Date and Time"
windows_eventlog where channel = 'Application' and eventid = '17' and data like '%BACKGROUND_SCAN%';