Check Microsoft Defender Status with PowerShell

# Check Microsoft Defender Status
# Single use case: report AV engine, definitions and protection state
# Author: SENTRI AI Engine | Date: 2026.08.14
#-----------------------------------------------------------------

function Write-Log {
    param(
        [Parameter(Mandatory)]
        [string]$Message,
        [ValidateSet('INFO','WARN','ERROR','OK')]
        [string]$Level = 'INFO'
    )
    $prefix = @{ INFO='[INFO]  '; WARN='[WARN]  '; ERROR='[ERROR] '; OK='[OK]    ' }[$Level]
    Write-Host "<WRITE-LOG = `"*$prefix$Message*`">"
}

# --- Parameters (replace via ServerEngine API parameters if needed) ---
$WarnDefinitionAgeDays = 3

$status = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($null -eq $status) {
    Write-Log "Microsoft Defender is not available on this host (3rd party AV or feature removed)." -Level WARN
    return
}

Write-Log "================ Defender Status ================"
Write-Log "Realtime protection: $($status.RealTimeProtectionEnabled)"
Write-Log "Antivirus enabled: $($status.AntivirusEnabled)"
Write-Log "Behavior monitoring: $($status.BehaviorMonitorEnabled)"
Write-Log "Tamper protection: $($status.IsTamperProtected)" -Level $(if ($status.IsTamperProtected) { 'OK' } else { 'WARN' })
Write-Log "Engine version: $($status.AMEngineVersion)"
Write-Log "Definitions version: $($status.AntivirusSignatureVersion)"
Write-Log "Definitions updated: $($status.AntivirusSignatureLastUpdated)"
Write-Log "Last quick scan: $(if ($status.QuickScanEndTime) { $status.QuickScanEndTime } else { 'never' })"

$problems = 0
if (-not $status.RealTimeProtectionEnabled) { Write-Log "WARNING: realtime protection is OFF!" -Level WARN; $problems++ }
if (-not $status.AntivirusEnabled)          { Write-Log "WARNING: antivirus is DISABLED!" -Level WARN; $problems++ }

$sigAge = $status.AntivirusSignatureAge
if ($sigAge -gt [int]$WarnDefinitionAgeDays) {
    Write-Log "WARNING: definitions are $sigAge days old (threshold: $WarnDefinitionAgeDays)!"
    $problems++
}

if ($problems -eq 0) {
    Write-Log "Defender check complete: protection healthy."
} else {
    Write-Log "Defender check complete: $problems problem(s) found!"
}