22.1 (L1) Ensure 'Allow Behavior Monitoring' is set to 'Allowed'

Information

This policy setting allows you to configure behavior monitoring for Microsoft Defender Antivirus.

The recommended state for this setting is: Allowed

When running an antivirus solution such as Microsoft Defender Antivirus, it is important to ensure that it is configured to heuristically monitor in real-time for suspicious and known malicious activity.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Allowed

Defender\Allow Behavior Monitoring

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/21767

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|8.1

Plugin: Windows

Control ID: a8f0803b1d2f5ab693711c93c1dc8ef7fc3f365fef2f0891d38a6ca4065d8fe5