Mini Kabibi Habibi

Current Path : C:/Users/All Users/Microsoft/Windows Defender/Platform/4.18.25110.5-0/
Upload File :
Current File : C:/Users/All Users/Microsoft/Windows Defender/Platform/4.18.25110.5-0/ProtectionManagement.mof

��#pragma autorecover

#pragma namespace("\\\\.\\root\\Microsoft\\Windows\\Defender")



Instance of __Win32Provider as $prov

{

  Name = "ProtectionManagement";

  ClsId = "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}";

  ImpersonationLevel = 1;

  HostingModel = "LocalServiceHost";

  version = 1073741825;

};



Instance of __MethodProviderRegistration

{

  Provider = $prov;

};



Instance of __EventProviderRegistration

{

  Provider = $prov;

  eventQueryList = {"select * from MSFT_MpEvent"};

};



Instance of __InstanceProviderRegistration

{

  Provider = $prov;

  supportsGet = TRUE;

  supportsPut = TRUE;

  supportsDelete = TRUE;

  supportsEnumeration = TRUE;

  QuerySupportLevels;

};



[locale(1033)] 

class BaseStatus

{

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpBehavioralNetworkBlockingRules : BaseStatus

{

  [key,read : ToSubclass] string FilterGUID = "";

  [read : ToSubclass] string IpAddress;

  [read : ToSubclass] string BlockingAction;

  [read : ToSubclass] string Direction;

  [read : ToSubclass] string Protocol;

  [read : ToSubclass] string LocalPorts;

  [read : ToSubclass] string RemotePorts;

  [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] string FilterGUID);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpComputerStatus : BaseStatus

{

  [read : ToSubclass,key] string ComputerID = "";

  [BitMap{"0", "1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ComputerState = 0;

  [read : ToSubclass] boolean RebootRequired;

  [BitMap{"0", "1", "2", "4", "8", "16", "32", "64", "128", "256", "512", "1024", "2048", "4096", "8192", "16384", "32768", "65536", "131072", "262144", "524288", "1048576", "2097152", "4194304", "8388608", "16777216"} : ToSubclass,read : ToSubclass] uint32 ProductStatus = 0;

  [read : ToSubclass] string AMRunningMode = "";

  [read : ToSubclass] string AMProductVersion = "";

  [read : ToSubclass] string AMServiceVersion = "";

  [read : ToSubclass] boolean DefenderSignaturesOutOfDate;

  string AntispywareSignatureVersion = "";

  [read : ToSubclass] uint32 AntispywareSignatureAge = 0;

  [read : ToSubclass] datetime AntispywareSignatureLastUpdated;

  [read : ToSubclass] string AntivirusSignatureVersion = "";

  [read : ToSubclass] uint32 AntivirusSignatureAge = 0;

  [read : ToSubclass] datetime AntivirusSignatureLastUpdated;

  string NISSignatureVersion = "";

  [read : ToSubclass] uint32 NISSignatureAge = 0;

  [read : ToSubclass] datetime NISSignatureLastUpdated;

  [read : ToSubclass] datetime FullScanStartTime;

  [read : ToSubclass] datetime FullScanEndTime;

  [read : ToSubclass] uint32 FullScanAge = 0;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastFullScanSource = 0;

  [read : ToSubclass] string FullScanSignatureVersion = "";

  [read : ToSubclass] boolean FullScanOverdue;

  [read : ToSubclass] boolean FullScanRequired;

  [ValueMap{"0", "1", "2"} : ToSubclass,read : ToSubclass] uint8 RealTimeScanDirection = 0;

  [read : ToSubclass] datetime QuickScanStartTime;

  [read : ToSubclass] datetime QuickScanEndTime;

  [read : ToSubclass] uint32 QuickScanAge = 0;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastQuickScanSource = 0;

  [read : ToSubclass] string QuickScanSignatureVersion = "";

  [read : ToSubclass] boolean QuickScanOverdue;

  [read : ToSubclass] string AMEngineVersion = "";

  [read : ToSubclass] boolean AMServiceEnabled = FALSE;

  [read : ToSubclass] boolean OnAccessProtectionEnabled = FALSE;

  [read : ToSubclass] boolean IoavProtectionEnabled = FALSE;

  [read : ToSubclass] boolean BehaviorMonitorEnabled = FALSE;

  [read : ToSubclass] boolean AntivirusEnabled = FALSE;

  [read : ToSubclass] boolean AntispywareEnabled = FALSE;

  [read : ToSubclass] boolean IsVirtualMachine = FALSE;

  [read : ToSubclass] boolean IsTamperProtected = FALSE;

  [read : ToSubclass] string TamperProtectionSource = "";

  [read : ToSubclass] boolean RealTimeProtectionEnabled = FALSE;

  [read : ToSubclass] string NISEngineVersion = "";

  [read : ToSubclass] boolean NISEnabled = FALSE;

  [read : ToSubclass] string TDTStatus = "";

  [read : ToSubclass] string TDTTelemetry = "";

  [read : ToSubclass] string TDTMode = "";

  [read : ToSubclass] string TDTSiloType = "";

  [read : ToSubclass] string TDTCapable = "";

  [read : ToSubclass] string DeviceControlState = "";

  [read : ToSubclass] string DeviceControlDefaultEnforcement = "";

  [read : ToSubclass] datetime DeviceControlPoliciesLastUpdated;

  [read : ToSubclass] string TroubleShootingMode = "";

  [read : ToSubclass] string TroubleShootingStartTime = "";

  [read : ToSubclass] string TroubleShootingEndTime = "";

  [read : ToSubclass] string TroubleShootingExpirationLeft = "";

  [read : ToSubclass] string TroubleShootingDailyQuotaLeft = "";

  [read : ToSubclass] string TroubleShootingQuotaResetTime = "";

  [read : ToSubclass] string TroubleShootingDailyMaxQuota = "";

  [read : ToSubclass] string TroubleShootingModeSource = "";

  [read : ToSubclass] string SmartAppControlState = "";

  [read : ToSubclass] string SmartAppControlExpiration = "";

  [read : ToSubclass] string InitializationProgress = "";

  [read : ToSubclass] uint8 ControlledConfigurationState = 0;

};



[Indication : ToSubclass DisableOverride,dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpEvent

{

  [ValueMap{"1", "2", "4", "8"} : ToSubclass,read : ToSubclass,key] uint32 CategoryDiscriminant;

  [BitMap{"1", "2"} : ToSubclass,read : ToSubclass] uint32 ScanNotificationsValue;

  [BitMap{"1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ThreatNotificationsValue;

  [BitMap{"1"} : ToSubclass,read : ToSubclass] uint32 SignatureNotificationsValue;

  [BitMap{"1", "2", "4", "8", "16", "32", "64"} : ToSubclass,read : ToSubclass] uint32 ComputerNotificationsValue;

  [read : ToSubclass] datetime NotificationTime;

  [read : ToSubclass] sint64 AdditionalData;

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpHeartBeat

{

  [implemented,static : ToSubclass DisableOverride] uint32 Send();

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpPreference

{

  [read : ToSubclass,key] string ComputerID = "";

  boolean DisableAutoExclusions = FALSE;

  string ExclusionPath[];

  string ExclusionExtension[];

  string ExclusionProcess[];

  string ExclusionIpAddress[];

  uint32 QuarantinePurgeItemsAfterDelay;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection = 0;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay;

  datetime RemediationScheduleTime;

  [ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 RemoteEncryptionProtectionConfiguredState;

  uint32 RemoteEncryptionProtectionMaxBlockTime;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RemoteEncryptionProtectionAggressiveness;

  string RemoteEncryptionProtectionExclusions[];

  [ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 BruteForceProtectionConfiguredState;

  uint32 BruteForceProtectionMaxBlockTime;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 BruteForceProtectionAggressiveness;

  string BruteForceProtectionExclusions[];

  boolean BruteForceProtectionLocalNetworkBlocking;

  boolean BruteForceProtectionSkipLearningPeriod;

  uint32 ReportingAdditionalActionTimeOut;

  uint32 ReportingCriticalFailureTimeOut;

  uint32 ReportingNonCriticalTimeOut;

  uint32 ServiceHealthReportInterval;

  boolean ReportDynamicSignatureDroppedEvent;

  uint8 ScanAvgCPULoadFactor;

  boolean CheckForSignaturesBeforeRunningScan;

  uint32 ScanPurgeItemsAfterDelay;

  boolean ScanOnlyIfIdleEnabled;

  [ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay;

  datetime ScanScheduleQuickScanTime;

  datetime ScanScheduleTime;

  boolean ThrottleForScheduledScanOnly;

  uint32 SignatureFirstAuGracePeriod;

  uint32 SignatureAuGracePeriod;

  string SignatureDefinitionUpdateFileSharesSources;

  boolean SignatureDisableUpdateOnStartupWithoutEngine;

  string SignatureFallbackOrder;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay;

  datetime SignatureScheduleTime;

  uint32 SignatureUpdateCatchupInterval;

  uint32 SignatureUpdateInterval;

  string SignatureBlobFileSharesSources;

  uint32 SignatureBlobUpdateInterval;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting;

  [ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent;

  boolean DisablePrivacyMode;

  boolean RandomizeScheduleTaskTimes;

  uint32 SchedulerRandomizationTime;

  boolean DisableBehaviorMonitoring;

  boolean DisableIOAVProtection;

  boolean DisableRealtimeMonitoring;

  boolean DisableScriptScanning;

  boolean DisableArchiveScanning;

  boolean DisableCatchupFullScan;

  boolean DisableCatchupQuickScan;

  boolean DisableEmailScanning;

  boolean DisableRemovableDriveScanning;

  boolean DisableRestorePoint;

  boolean DisableScanningMappedNetworkDrivesForFullScan;

  boolean DisableScanningNetworkFiles;

  boolean ApplyDisableNetworkScanningToIOAV;

  boolean UILockdown;

  sint64 ThreatIDDefaultAction_Ids[];

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[];

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection;

  boolean DisableBlockAtFirstSeen;

  [ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel;

  uint32 CloudExtendedTimeout;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess;

  string AttackSurfaceReductionOnlyExclusions[];

  string AttackSurfaceReductionRules_Ids[];

  [ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[];

  string ControlledFolderAccessAllowedApplications[];

  string ControlledFolderAccessProtectedFolders[];

  string ControlledFolderAccessDefaultProtectedFolders[];

  string SharedSignaturesPath;

  boolean SharedSignaturesPathUpdateAtScheduledTimeOnly;

  boolean EnableLowCpuPriority;

  boolean EnableFileHashComputation;

  boolean MeteredConnectionUpdates;

  boolean AllowNetworkProtectionOnWinServer;

  boolean DisableDatagramProcessing;

  boolean EnableConvertWarnToBlock;

  boolean DisableCpuThrottleOnIdleScans;

  boolean EnableFullScanOnBatteryPower;

  string ProxyPacUrl;

  string ProxyServer;

  string ProxyBypass[];

  boolean ForceUseProxyOnly;

  boolean DisableTlsParsing;

  boolean DisableHttpParsing;

  boolean DisableDnsParsing;

  boolean DisableDnsOverTcpParsing;

  boolean DisableSshParsing;

  [ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 PlatformUpdatesChannel;

  [ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 EngineUpdatesChannel;

  [ValueMap{"0", "4", "5"} : ToSubclass] uint8 DefinitionUpdatesChannel;

  boolean DisableGradualRelease;

  boolean AllowNetworkProtectionDownLevel;

  boolean AllowDatagramProcessingOnWinServer;

  boolean EnableDnsSinkhole;

  boolean DisableInboundConnectionFiltering;

  boolean DisableRdpParsing;

  boolean DisableNetworkProtectionPerfTelemetry;

  uint32 TrustLabelProtectionStatus;

  boolean HideExclusionsFromLocalUsers;

  boolean DisableFtpParsing;

  boolean AllowSwitchToAsyncInspection;

  uint32 ScanScheduleOffset;

  boolean DisableTamperProtection;

  boolean DisableSmtpParsing;

  boolean DisableQuicParsing;

  uint32 NetworkProtectionReputationMode;

  boolean IntelTDTEnabled;

  string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[];

  string AttackSurfaceReductionRules_RuleSpecificExclusions[];

  boolean OobeEnableRtpAndSigUpdate;

  [ValueMap{"0", "1"} : ToSubclass] uint8 PerformanceModeStatus;

  boolean DisableCacheMaintenance;

  [ValueMap{"0", "1"} : ToSubclass] uint8 QuickScanIncludeExclusions;

  boolean RemoveScanningThreadPoolCap;

  boolean DisableCoreServiceECSIntegration;

  boolean DisableCoreServiceTelemetry;

  boolean EnableUdpSegmentationOffload;

  boolean EnableUdpReceiveOffload;

  [implemented,static : ToSubclass DisableOverride] uint32 Set([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] uint32 QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay,[In] datetime RemediationScheduleTime,[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 RemoteEncryptionProtectionConfiguredState,[In] uint32 RemoteEncryptionProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RemoteEncryptionProtectionAggressiveness,[In] string RemoteEncryptionProtectionExclusions[],[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 BruteForceProtectionConfiguredState,[In] uint32 BruteForceProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 BruteForceProtectionAggressiveness,[In] string BruteForceProtectionExclusions[],[In] boolean BruteForceProtectionLocalNetworkBlocking,[In] boolean BruteForceProtectionSkipLearningPeriod,[In] uint32 ReportingAdditionalActionTimeOut,[In] uint32 ReportingCriticalFailureTimeOut,[In] uint32 ReportingNonCriticalTimeOut,[In] uint32 ServiceHealthReportInterval,[In] boolean ReportDynamicSignatureDroppedEvent,[In] uint8 ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] uint32 ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay,[In] datetime ScanScheduleQuickScanTime,[In] datetime ScanScheduleTime,[In] boolean ThrottleForScheduledScanOnly,[In] uint32 SignatureFirstAuGracePeriod,[In] uint32 SignatureAuGracePeriod,[In] string SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] string SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay,[In] datetime SignatureScheduleTime,[In] uint32 SignatureUpdateCatchupInterval,[In] string SignatureBlobFileSharesSources,[In] uint32 SignatureUpdateInterval,[In] uint32 SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] uint32 SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean ApplyDisableNetworkScanningToIOAV,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel,[In] uint32 CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean SharedSignaturesPathUpdateAtScheduledTimeOnly,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean EnableConvertWarnToBlock,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] string ProxyPacUrl,[In] string ProxyServer,[In] string ProxyBypass[],[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In,ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 PlatformUpdatesChannel,[In,ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 EngineUpdatesChannel,[In,ValueMap{"0", "4", "5"} : ToSubclass] uint8 DefinitionUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean DisableNetworkProtectionPerfTelemetry,[In] uint32 TrustLabelProtectionStatus,[In] boolean DisableFtpParsing,[In] boolean AllowSwitchToAsyncInspection,[In] uint32 ScanScheduleOffset,[In] boolean DisableTDTFeature,[In] boolean DisableTamperProtection,[In] boolean DisableSmtpParsing,[In] boolean DisableQuicParsing,[In] uint32 NetworkProtectionReputationMode,[In] boolean IntelTDTEnabled,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[],[In] string AttackSurfaceReductionRules_RuleSpecificExclusions[],[In] boolean OobeEnableRtpAndSigUpdate,[In,ValueMap{"0", "1"} : ToSubclass] uint8 PerformanceModeStatus,[In,ValueMap{"0", "1"} : ToSubclass] uint8 QuickScanIncludeExclusions,[In] boolean RemoveScanningThreadPoolCap,[In] boolean DisableCacheMaintenance,[In] boolean DisableCoreServiceECSIntegration,[In] boolean DisableCoreServiceTelemetry,[In] boolean EnableUdpSegmentationOffload,[In] boolean EnableUdpReceiveOffload,[In] boolean Force);

  [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] boolean QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean RemediationScheduleDay,[In] boolean RemediationScheduleTime,[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] boolean RemoteEncryptionProtectionConfiguredState,[In] boolean RemoteEncryptionProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RemoteEncryptionProtectionAggressiveness,[In] string RemoteEncryptionProtectionExclusions[],[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] boolean BruteForceProtectionConfiguredState,[In] boolean BruteForceProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean BruteForceProtectionAggressiveness,[In] string BruteForceProtectionExclusions[],[In] boolean BruteForceProtectionLocalNetworkBlocking,[In] boolean BruteForceProtectionSkipLearningPeriod,[In] boolean ReportingAdditionalActionTimeOut,[In] boolean ReportingCriticalFailureTimeOut,[In] boolean ReportingNonCriticalTimeOut,[In] boolean ServiceHealthReportInterval,[In] boolean ReportDynamicSignatureDroppedEvent,[In] boolean ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] boolean ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] boolean ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean ScanScheduleDay,[In] boolean ScanScheduleQuickScanTime,[In] boolean ScanScheduleTime,[In] boolean ThrottleForScheduledScanOnly,[In] boolean SignatureFirstAuGracePeriod,[In] boolean SignatureAuGracePeriod,[In] boolean SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] boolean SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean SignatureScheduleDay,[In] boolean SignatureScheduleTime,[In] boolean SignatureUpdateCatchupInterval,[In] boolean SignatureBlobFileSharesSources,[In] boolean SignatureUpdateInterval,[In] boolean SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] boolean SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] boolean SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean ApplyDisableNetworkScanningToIOAV,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] boolean CloudBlockLevel,[In] boolean CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] boolean EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] boolean SharedSignaturesPath,[In] boolean SharedSignaturesPathUpdateAtScheduledTimeOnly,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean EnableConvertWarnToBlock,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] boolean ProxyPacUrl,[In] boolean ProxyServer,[In] boolean ProxyBypass,[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In] boolean PlatformUpdatesChannel,[In] boolean EngineUpdatesChannel,[In] boolean DefinitionUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean DisableNetworkProtectionPerfTelemetry,[In] boolean TrustLabelProtectionStatus,[In] boolean DisableFtpParsing,[In] boolean AllowSwitchToAsyncInspection,[In] boolean ScanScheduleOffset,[In] boolean DisableTDTFeature,[In] boolean DisableSmtpParsing,[In] boolean DisableQuicParsing,[In] boolean NetworkProtectionReputationMode,[In] boolean IntelTDTEnabled,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions,[In] boolean OobeEnableRtpAndSigUpdate,[In,ValueMap{"0", "1"} : ToSubclass] boolean PerformanceModeStatus,[In,ValueMap{"0", "1"} : ToSubclass] boolean QuickScanIncludeExclusions,[In] boolean RemoveScanningThreadPoolCap,[In] boolean DisableCacheMaintenance,[In] boolean DisableCoreServiceECSIntegration,[In] boolean DisableCoreServiceTelemetry,[In] boolean EnableUdpSegmentationOffload,[In] boolean EnableUdpReceiveOffload,[In] boolean Force);

  [implemented,static : ToSubclass DisableOverride] uint32 Add([In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[in] string SharedSignaturesPath,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[],[In] string AttackSurfaceReductionRules_RuleSpecificExclusions[],[In] string RemoteEncryptionProtectionExclusions[],[In] string BruteForceProtectionExclusions[],[In] boolean Force);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpRollback

{

  [implemented,static : ToSubclass DisableOverride] uint32 Start([In] boolean Engine,[In] boolean Platform);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpScan

{

  [implemented,static : ToSubclass DisableOverride] uint32 Start([In] uint8 ScanType,[In] string ScanPath);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpSignature

{

  [implemented,static : ToSubclass DisableOverride] uint32 Update([In] uint8 UpdateSource);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpThreat : BaseStatus

{

  [read : ToSubclass] string SchemaVersion = "1.0.0.0";

  [key,read : ToSubclass] sint64 ThreatID;

  [read : ToSubclass] string ThreatName;

  [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID;

  [BitMap{"0", "1", "2", "4", "8", "16", "32"} : ToSubclass,read : ToSubclass] uint32 RollupStatus;

  [read : ToSubclass] string Resources[];

  [read : ToSubclass] boolean DidThreatExecute = FALSE;

  [read : ToSubclass] boolean IsActive = FALSE;

  [implemented,static : ToSubclass DisableOverride] uint32 Remove();

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpThreatCatalog : BaseStatus

{

  [key,read : ToSubclass] sint64 ThreatID;

  [read : ToSubclass] string ThreatName;

  [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID;

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpThreatDetection : BaseStatus

{

  [key,read : ToSubclass] string DetectionID;

  [key,read : ToSubclass] sint64 ThreatID;

  [read : ToSubclass] string ProcessName;

  [read : ToSubclass] string DomainUser;

  [ValueMap{"0", "1", "2", "3", "4", "5", "7", "8", "9"} : ToSubclass,read : ToSubclass] uint8 DetectionSourceTypeID;

  [read : ToSubclass] string Resources[];

  [read : ToSubclass] datetime InitialDetectionTime;

  [read : ToSubclass] datetime LastThreatStatusChangeTime;

  [read : ToSubclass] datetime RemediationTime;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 CurrentThreatExecutionStatusID;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "Blocked", "102", "103", "104", "105", "107"} : ToSubclass,read : ToSubclass] uint8 ThreatStatusID;

  [read : ToSubclass] sint32 ThreatStatusErrorCode;

  [BitMap{"0", "1", "2", "3", "6", "8", "9", "10"} : ToSubclass,read : ToSubclass] uint8 CleaningActionID;

  [read : ToSubclass] string AMProductVersion = "";

  [read : ToSubclass] boolean ActionSuccess = FALSE;

  [ValueMap{"0", "4", "8", "12", "16", "20", "24", "28", "32768", "32772", "32776", "32780", "32784", "32788", "32792", "32796"} : ToSubclass,read : ToSubclass] uint32 AdditionalActionsBitMask;

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpWDOScan

{

  [implemented,static : ToSubclass DisableOverride] uint32 Start();

};



// This duplication of provider registration is required to support 'ProtectionManagement' class on Defender

#pragma namespace("\\\\.\\root\\Microsoft\\ProtectionManagement")



Instance of __Win32Provider as $prov1

{

  Name = "ProtectionManagement";

  ClsId = "{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}";

  ImpersonationLevel = 1;

  HostingModel = "LocalServiceHost";

  version = 1073741825;

};



Instance of __MethodProviderRegistration

{

  Provider = $prov1;

};



Instance of __EventProviderRegistration

{

  Provider = $prov1;

  eventQueryList = {"select * from MSFT_MpEvent"};

};



Instance of __InstanceProviderRegistration

{

  Provider = $prov1;

  supportsGet = TRUE;

  supportsPut = TRUE;

  supportsDelete = TRUE;

  supportsEnumeration = TRUE;

  QuerySupportLevels;

};



[locale(1033)] 

class BaseStatus

{

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpBehavioralNetworkBlockingRules : BaseStatus

{

  [key,read : ToSubclass] string FilterGUID = "";

  [read : ToSubclass] string IpAddress;

  [read : ToSubclass] string BlockingAction;

  [read : ToSubclass] string Direction;

  [read : ToSubclass] string Protocol;

  [read : ToSubclass] string LocalPorts;

  [read : ToSubclass] string RemotePorts;

  [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] string FilterGUID);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpComputerStatus : BaseStatus

{

  [read : ToSubclass,key] string ComputerID = "";

  [BitMap{"0", "1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ComputerState = 0;

  [read : ToSubclass] boolean RebootRequired;

  [BitMap{"0", "1", "2", "4", "8", "16", "32", "64", "128", "256", "512", "1024", "2048", "4096", "8192", "16384", "32768", "65536", "131072", "262144", "524288", "1048576", "2097152", "4194304", "8388608", "16777216"} : ToSubclass,read : ToSubclass] uint32 ProductStatus = 0;

  [read : ToSubclass] string AMRunningMode = "";

  [read : ToSubclass] string AMProductVersion = "";

  [read : ToSubclass] string AMServiceVersion = "";

  [read : ToSubclass] boolean DefenderSignaturesOutOfDate;

  string AntispywareSignatureVersion = "";

  [read : ToSubclass] uint32 AntispywareSignatureAge = 0;

  [read : ToSubclass] datetime AntispywareSignatureLastUpdated;

  [read : ToSubclass] string AntivirusSignatureVersion = "";

  [read : ToSubclass] uint32 AntivirusSignatureAge = 0;

  [read : ToSubclass] datetime AntivirusSignatureLastUpdated;

  string NISSignatureVersion = "";

  [read : ToSubclass] uint32 NISSignatureAge = 0;

  [read : ToSubclass] datetime NISSignatureLastUpdated;

  [read : ToSubclass] datetime FullScanStartTime;

  [read : ToSubclass] datetime FullScanEndTime;

  [read : ToSubclass] uint32 FullScanAge = 0;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastFullScanSource = 0;

  [read : ToSubclass] string FullScanSignatureVersion = "";

  [read : ToSubclass] boolean FullScanOverdue;

  [read : ToSubclass] boolean FullScanRequired;

  [ValueMap{"0", "1", "2"} : ToSubclass,read : ToSubclass] uint8 RealTimeScanDirection = 0;

  [read : ToSubclass] datetime QuickScanStartTime;

  [read : ToSubclass] datetime QuickScanEndTime;

  [read : ToSubclass] uint32 QuickScanAge = 0;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 LastQuickScanSource = 0;

  [read : ToSubclass] string QuickScanSignatureVersion = "";

  [read : ToSubclass] boolean QuickScanOverdue;

  [read : ToSubclass] string AMEngineVersion = "";

  [read : ToSubclass] boolean AMServiceEnabled = FALSE;

  [read : ToSubclass] boolean OnAccessProtectionEnabled = FALSE;

  [read : ToSubclass] boolean IoavProtectionEnabled = FALSE;

  [read : ToSubclass] boolean BehaviorMonitorEnabled = FALSE;

  [read : ToSubclass] boolean AntivirusEnabled = FALSE;

  [read : ToSubclass] boolean AntispywareEnabled = FALSE;

  [read : ToSubclass] boolean IsVirtualMachine = FALSE;

  [read : ToSubclass] boolean IsTamperProtected = FALSE;

  [read : ToSubclass] string TamperProtectionSource = "";

  [read : ToSubclass] boolean RealTimeProtectionEnabled = FALSE;

  [read : ToSubclass] string NISEngineVersion = "";

  [read : ToSubclass] boolean NISEnabled = FALSE;

  [read : ToSubclass] string TDTStatus = "";

  [read : ToSubclass] string TDTTelemetry = "";

  [read : ToSubclass] string TDTMode = "";

  [read : ToSubclass] string TDTSiloType = "";

  [read : ToSubclass] string TDTCapable = "";

  [read : ToSubclass] string DeviceControlState = "";

  [read : ToSubclass] string DeviceControlDefaultEnforcement = "";

  [read : ToSubclass] datetime DeviceControlPoliciesLastUpdated;

  [read : ToSubclass] string TroubleShootingMode = "";

  [read : ToSubclass] string TroubleShootingStartTime = "";

  [read : ToSubclass] string TroubleShootingEndTime = "";

  [read : ToSubclass] string TroubleShootingExpirationLeft = "";

  [read : ToSubclass] string TroubleShootingDailyQuotaLeft = "";

  [read : ToSubclass] string TroubleShootingQuotaResetTime = "";

  [read : ToSubclass] string TroubleShootingDailyMaxQuota = "";

  [read : ToSubclass] string TroubleShootingModeSource = "";

  [read : ToSubclass] string SmartAppControlState = "";

  [read : ToSubclass] string SmartAppControlExpiration = "";

  [read : ToSubclass] string InitializationProgress = "";

  [read : ToSubclass] uint8 ControlledConfigurationState = 0;

};



[Indication : ToSubclass DisableOverride,dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpEvent

{

  [ValueMap{"1", "2", "4", "8"} : ToSubclass,read : ToSubclass,key] uint32 CategoryDiscriminant;

  [BitMap{"1", "2"} : ToSubclass,read : ToSubclass] uint32 ScanNotificationsValue;

  [BitMap{"1", "2", "4", "8", "16"} : ToSubclass,read : ToSubclass] uint32 ThreatNotificationsValue;

  [BitMap{"1"} : ToSubclass,read : ToSubclass] uint32 SignatureNotificationsValue;

  [BitMap{"1", "2", "4", "8", "16", "32", "64"} : ToSubclass,read : ToSubclass] uint32 ComputerNotificationsValue;

  [read : ToSubclass] datetime NotificationTime;

  [read : ToSubclass] sint64 AdditionalData;

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpHeartBeat

{

  [implemented,static : ToSubclass DisableOverride] uint32 Send();

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpPreference

{

  [read : ToSubclass,key] string ComputerID = "";

  boolean DisableAutoExclusions = FALSE;

  string ExclusionPath[];

  string ExclusionExtension[];

  string ExclusionProcess[];

  string ExclusionIpAddress[];

  uint32 QuarantinePurgeItemsAfterDelay;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection = 0;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay;

  datetime RemediationScheduleTime;

  [ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 RemoteEncryptionProtectionConfiguredState;

  uint32 RemoteEncryptionProtectionMaxBlockTime;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 RemoteEncryptionProtectionAggressiveness;

  string RemoteEncryptionProtectionExclusions[];

  [ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 BruteForceProtectionConfiguredState;

  uint32 BruteForceProtectionMaxBlockTime;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 BruteForceProtectionAggressiveness;

  string BruteForceProtectionExclusions[];

  boolean BruteForceProtectionLocalNetworkBlocking;

  boolean BruteForceProtectionSkipLearningPeriod;

  uint32 ReportingAdditionalActionTimeOut;

  uint32 ReportingCriticalFailureTimeOut;

  uint32 ReportingNonCriticalTimeOut;

  uint32 ServiceHealthReportInterval;

  boolean ReportDynamicSignatureDroppedEvent;

  uint8 ScanAvgCPULoadFactor;

  boolean CheckForSignaturesBeforeRunningScan;

  uint32 ScanPurgeItemsAfterDelay;

  boolean ScanOnlyIfIdleEnabled;

  [ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay;

  datetime ScanScheduleQuickScanTime;

  datetime ScanScheduleTime;

  boolean ThrottleForScheduledScanOnly;

  uint32 SignatureFirstAuGracePeriod;

  uint32 SignatureAuGracePeriod;

  string SignatureDefinitionUpdateFileSharesSources;

  boolean SignatureDisableUpdateOnStartupWithoutEngine;

  string SignatureFallbackOrder;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay;

  datetime SignatureScheduleTime;

  uint32 SignatureUpdateCatchupInterval;

  uint32 SignatureUpdateInterval;

  string SignatureBlobFileSharesSources;

  uint32 SignatureBlobUpdateInterval;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting;

  [ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent;

  boolean DisablePrivacyMode;

  boolean RandomizeScheduleTaskTimes;

  uint32 SchedulerRandomizationTime;

  boolean DisableBehaviorMonitoring;

  boolean DisableIOAVProtection;

  boolean DisableRealtimeMonitoring;

  boolean DisableScriptScanning;

  boolean DisableArchiveScanning;

  boolean DisableCatchupFullScan;

  boolean DisableCatchupQuickScan;

  boolean DisableEmailScanning;

  boolean DisableRemovableDriveScanning;

  boolean DisableRestorePoint;

  boolean DisableScanningMappedNetworkDrivesForFullScan;

  boolean DisableScanningNetworkFiles;

  boolean ApplyDisableNetworkScanningToIOAV;

  boolean UILockdown;

  sint64 ThreatIDDefaultAction_Ids[];

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[];

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction;

  [ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection;

  boolean DisableBlockAtFirstSeen;

  [ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel;

  uint32 CloudExtendedTimeout;

  [ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess;

  string AttackSurfaceReductionOnlyExclusions[];

  string AttackSurfaceReductionRules_Ids[];

  [ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[];

  string ControlledFolderAccessAllowedApplications[];

  string ControlledFolderAccessProtectedFolders[];

  string ControlledFolderAccessDefaultProtectedFolders[];

  string SharedSignaturesPath;

  boolean SharedSignaturesPathUpdateAtScheduledTimeOnly;

  boolean EnableLowCpuPriority;

  boolean EnableFileHashComputation;

  boolean MeteredConnectionUpdates;

  boolean AllowNetworkProtectionOnWinServer;

  boolean DisableDatagramProcessing;

  boolean EnableConvertWarnToBlock;

  boolean DisableCpuThrottleOnIdleScans;

  boolean EnableFullScanOnBatteryPower;

  string ProxyPacUrl;

  string ProxyServer;

  string ProxyBypass[];

  boolean ForceUseProxyOnly;

  boolean DisableTlsParsing;

  boolean DisableHttpParsing;

  boolean DisableDnsParsing;

  boolean DisableDnsOverTcpParsing;

  boolean DisableSshParsing;

  [ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 PlatformUpdatesChannel;

  [ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 EngineUpdatesChannel;

  [ValueMap{"0", "4", "5"} : ToSubclass] uint8 DefinitionUpdatesChannel;

  boolean DisableGradualRelease;

  boolean AllowNetworkProtectionDownLevel;

  boolean AllowDatagramProcessingOnWinServer;

  boolean EnableDnsSinkhole;

  boolean DisableInboundConnectionFiltering;

  boolean DisableRdpParsing;

  boolean DisableNetworkProtectionPerfTelemetry;

  uint32 TrustLabelProtectionStatus;

  boolean HideExclusionsFromLocalUsers;

  boolean DisableFtpParsing;

  boolean AllowSwitchToAsyncInspection;

  uint32 ScanScheduleOffset;

  boolean DisableTamperProtection;

  boolean DisableSmtpParsing;

  boolean DisableQuicParsing;

  uint32 NetworkProtectionReputationMode;

  boolean IntelTDTEnabled;

  string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[];

  string AttackSurfaceReductionRules_RuleSpecificExclusions[];

  boolean OobeEnableRtpAndSigUpdate;

  [ValueMap{"0", "1"} : ToSubclass] uint8 PerformanceModeStatus;

  boolean DisableCacheMaintenance;

  [ValueMap{"0", "1"} : ToSubclass] uint8 QuickScanIncludeExclusions;

  boolean RemoveScanningThreadPoolCap;

  boolean DisableCoreServiceECSIntegration;

  boolean DisableCoreServiceTelemetry;

  boolean EnableUdpSegmentationOffload;

  boolean EnableUdpReceiveOffload;

  [implemented,static : ToSubclass DisableOverride] uint32 Set([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] uint32 QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 RemediationScheduleDay,[In] datetime RemediationScheduleTime,[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 RemoteEncryptionProtectionConfiguredState,[In] uint32 RemoteEncryptionProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 RemoteEncryptionProtectionAggressiveness,[In] string RemoteEncryptionProtectionExclusions[],[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] uint8 BruteForceProtectionConfiguredState,[In] uint32 BruteForceProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 BruteForceProtectionAggressiveness,[In] string BruteForceProtectionExclusions[],[In] boolean BruteForceProtectionLocalNetworkBlocking,[In] boolean BruteForceProtectionSkipLearningPeriod,[In] uint32 ReportingAdditionalActionTimeOut,[In] uint32 ReportingCriticalFailureTimeOut,[In] uint32 ReportingNonCriticalTimeOut,[In] uint32 ServiceHealthReportInterval,[In] boolean ReportDynamicSignatureDroppedEvent,[In] uint8 ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] uint32 ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] uint8 ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 ScanScheduleDay,[In] datetime ScanScheduleQuickScanTime,[In] datetime ScanScheduleTime,[In] boolean ThrottleForScheduledScanOnly,[In] uint32 SignatureFirstAuGracePeriod,[In] uint32 SignatureAuGracePeriod,[In] string SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] string SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] uint8 SignatureScheduleDay,[In] datetime SignatureScheduleTime,[In] uint32 SignatureUpdateCatchupInterval,[In] string SignatureBlobFileSharesSources,[In] uint32 SignatureUpdateInterval,[In] uint32 SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] uint8 SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] uint32 SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean ApplyDisableNetworkScanningToIOAV,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] uint8 CloudBlockLevel,[In] uint32 CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] uint8 EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] uint8 EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] string SharedSignaturesPath,[In] boolean SharedSignaturesPathUpdateAtScheduledTimeOnly,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean EnableConvertWarnToBlock,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] string ProxyPacUrl,[In] string ProxyServer,[In] string ProxyBypass[],[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In,ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 PlatformUpdatesChannel,[In,ValueMap{"0", "2", "3", "4", "5", "6"} : ToSubclass] uint8 EngineUpdatesChannel,[In,ValueMap{"0", "4", "5"} : ToSubclass] uint8 DefinitionUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean DisableNetworkProtectionPerfTelemetry,[In] uint32 TrustLabelProtectionStatus,[In] boolean DisableFtpParsing,[In] boolean AllowSwitchToAsyncInspection,[In] uint32 ScanScheduleOffset,[In] boolean DisableTDTFeature,[In] boolean DisableTamperProtection,[In] boolean DisableSmtpParsing,[In] boolean DisableQuicParsing,[In] uint32 NetworkProtectionReputationMode,[In] boolean IntelTDTEnabled,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[],[In] string AttackSurfaceReductionRules_RuleSpecificExclusions[],[In] boolean OobeEnableRtpAndSigUpdate,[In,ValueMap{"0", "1"} : ToSubclass] uint8 PerformanceModeStatus,[In,ValueMap{"0", "1"} : ToSubclass] uint8 QuickScanIncludeExclusions,[In] boolean RemoveScanningThreadPoolCap,[In] boolean DisableCacheMaintenance,[In] boolean DisableCoreServiceECSIntegration,[In] boolean DisableCoreServiceTelemetry,[In] boolean EnableUdpSegmentationOffload,[In] boolean EnableUdpReceiveOffload,[In] boolean Force);

  [implemented,static : ToSubclass DisableOverride] uint32 Remove([In] boolean DisableAutoExclusions,[In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] boolean QuarantinePurgeItemsAfterDelay,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RealTimeScanDirection,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean RemediationScheduleDay,[In] boolean RemediationScheduleTime,[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] boolean RemoteEncryptionProtectionConfiguredState,[In] boolean RemoteEncryptionProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean RemoteEncryptionProtectionAggressiveness,[In] string RemoteEncryptionProtectionExclusions[],[In,ValueMap{"0", "1", "2", "4"} : ToSubclass] boolean BruteForceProtectionConfiguredState,[In] boolean BruteForceProtectionMaxBlockTime,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean BruteForceProtectionAggressiveness,[In] string BruteForceProtectionExclusions[],[In] boolean BruteForceProtectionLocalNetworkBlocking,[In] boolean BruteForceProtectionSkipLearningPeriod,[In] boolean ReportingAdditionalActionTimeOut,[In] boolean ReportingCriticalFailureTimeOut,[In] boolean ReportingNonCriticalTimeOut,[In] boolean ServiceHealthReportInterval,[In] boolean ReportDynamicSignatureDroppedEvent,[In] boolean ScanAvgCPULoadFactor,[In] boolean CheckForSignaturesBeforeRunningScan,[In] boolean ScanPurgeItemsAfterDelay,[In] boolean ScanOnlyIfIdleEnabled,[In,ValueMap{"1", "2"} : ToSubclass] boolean ScanParameters,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean ScanScheduleDay,[In] boolean ScanScheduleQuickScanTime,[In] boolean ScanScheduleTime,[In] boolean ThrottleForScheduledScanOnly,[In] boolean SignatureFirstAuGracePeriod,[In] boolean SignatureAuGracePeriod,[In] boolean SignatureDefinitionUpdateFileSharesSources,[In] boolean SignatureDisableUpdateOnStartupWithoutEngine,[In] boolean SignatureFallbackOrder,[In,ValueMap{"0", "1", "2", "3", "4", "5", "6", "7", "8"} : ToSubclass] boolean SignatureScheduleDay,[In] boolean SignatureScheduleTime,[In] boolean SignatureUpdateCatchupInterval,[In] boolean SignatureBlobFileSharesSources,[In] boolean SignatureUpdateInterval,[In] boolean SignatureBlobUpdateInterval,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean MAPSReporting,[In,ValueMap{"0", "1", "2", "3"} : ToSubclass] boolean SubmitSamplesConsent,[In] boolean DisablePrivacyMode,[In] boolean RandomizeScheduleTaskTimes,[In] boolean SchedulerRandomizationTime,[In] boolean DisableBehaviorMonitoring,[In] boolean DisableIntrusionPreventionSystem,[In] boolean DisableIOAVProtection,[In] boolean DisableRealtimeMonitoring,[In] boolean DisableScriptScanning,[In] boolean DisableArchiveScanning,[In] boolean DisableCatchupFullScan,[In] boolean DisableCatchupQuickScan,[In] boolean DisableEmailScanning,[In] boolean DisableRemovableDriveScanning,[In] boolean DisableRestorePoint,[In] boolean DisableScanningMappedNetworkDrivesForFullScan,[In] boolean DisableScanningNetworkFiles,[In] boolean ApplyDisableNetworkScanningToIOAV,[In] boolean UILockdown,[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean UnknownThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean LowThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean ModerateThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean HighThreatDefaultAction,[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] boolean SevereThreatDefaultAction,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean PUAProtection,[In] boolean DisableBlockAtFirstSeen,[In,ValueMap{"0", "1", "2", "4", "6"} : ToSubclass] boolean CloudBlockLevel,[In] boolean CloudExtendedTimeout,[In,ValueMap{"0", "1", "2"} : ToSubclass] boolean EnableNetworkProtection,[In,ValueMap{"0", "1", "2", "3", "4"} : ToSubclass] boolean EnableControlledFolderAccess,[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[In] boolean SharedSignaturesPath,[In] boolean SharedSignaturesPathUpdateAtScheduledTimeOnly,[In] boolean EnableLowCpuPriority,[In] boolean EnableFileHashComputation,[In] boolean MeteredConnectionUpdates,[In] boolean AllowNetworkProtectionOnWinServer,[In] boolean DisableDatagramProcessing,[In] boolean EnableConvertWarnToBlock,[In] boolean DisableCpuThrottleOnIdleScans,[In] boolean EnableFullScanOnBatteryPower,[In] boolean ProxyPacUrl,[In] boolean ProxyServer,[In] boolean ProxyBypass,[In] boolean ForceUseProxyOnly,[In] boolean DisableTlsParsing,[In] boolean DisableHttpParsing,[In] boolean DisableDnsParsing,[In] boolean DisableDnsOverTcpParsing,[In] boolean DisableSshParsing,[In] boolean PlatformUpdatesChannel,[In] boolean EngineUpdatesChannel,[In] boolean DefinitionUpdatesChannel,[In] boolean DisableGradualRelease,[In] boolean AllowNetworkProtectionDownLevel,[In] boolean AllowDatagramProcessingOnWinServer,[In] boolean EnableDnsSinkhole,[In] boolean DisableInboundConnectionFiltering,[In] boolean DisableRdpParsing,[In] boolean DisableNetworkProtectionPerfTelemetry,[In] boolean TrustLabelProtectionStatus,[In] boolean DisableFtpParsing,[In] boolean AllowSwitchToAsyncInspection,[In] boolean ScanScheduleOffset,[In] boolean DisableTDTFeature,[In] boolean DisableSmtpParsing,[In] boolean DisableQuicParsing,[In] boolean NetworkProtectionReputationMode,[In] boolean IntelTDTEnabled,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions,[In] boolean OobeEnableRtpAndSigUpdate,[In,ValueMap{"0", "1"} : ToSubclass] boolean PerformanceModeStatus,[In,ValueMap{"0", "1"} : ToSubclass] boolean QuickScanIncludeExclusions,[In] boolean RemoveScanningThreadPoolCap,[In] boolean DisableCacheMaintenance,[In] boolean DisableCoreServiceECSIntegration,[In] boolean DisableCoreServiceTelemetry,[In] boolean EnableUdpSegmentationOffload,[In] boolean EnableUdpReceiveOffload,[In] boolean Force);

  [implemented,static : ToSubclass DisableOverride] uint32 Add([In] string ExclusionPath[],[In] string ExclusionExtension[],[In] string ExclusionProcess[],[In] string ExclusionIpAddress[],[In] sint64 ThreatIDDefaultAction_Ids[],[In,ValueMap{"1", "2", "3", "6", "8", "9", "10"} : ToSubclass] uint8 ThreatIDDefaultAction_Actions[],[In] string AttackSurfaceReductionOnlyExclusions[],[In] string AttackSurfaceReductionRules_Ids[],[In,ValueMap{"0", "1", "2", "5", "6"} : ToSubclass] uint8 AttackSurfaceReductionRules_Actions[],[In] string ControlledFolderAccessAllowedApplications[],[In] string ControlledFolderAccessProtectedFolders[],[in] string SharedSignaturesPath,[In] string AttackSurfaceReductionRules_RuleSpecificExclusions_Id[],[In] string AttackSurfaceReductionRules_RuleSpecificExclusions[],[In] string RemoteEncryptionProtectionExclusions[],[In] string BruteForceProtectionExclusions[],[In] boolean Force);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpRollback

{

  [implemented,static : ToSubclass DisableOverride] uint32 Start([In] boolean Engine,[In] boolean Platform);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpScan

{

  [implemented,static : ToSubclass DisableOverride] uint32 Start([In] uint8 ScanType,[In] string ScanPath);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpSignature

{

  [implemented,static : ToSubclass DisableOverride] uint32 Update([In] uint8 UpdateSource);

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpThreat : BaseStatus

{

  [read : ToSubclass] string SchemaVersion = "1.0.0.0";

  [key,read : ToSubclass] sint64 ThreatID;

  [read : ToSubclass] string ThreatName;

  [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID;

  [BitMap{"0", "1", "2", "4", "8", "16", "32"} : ToSubclass,read : ToSubclass] uint32 RollupStatus;

  [read : ToSubclass] string Resources[];

  [read : ToSubclass] boolean DidThreatExecute = FALSE;

  [read : ToSubclass] boolean IsActive = FALSE;

  [implemented,static : ToSubclass DisableOverride] uint32 Remove();

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpThreatCatalog : BaseStatus

{

  [key,read : ToSubclass] sint64 ThreatID;

  [read : ToSubclass] string ThreatName;

  [ValueMap{"0", "1", "2", "3", "4", "5"} : ToSubclass,read : ToSubclass] uint8 SeverityID;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "7,8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "36", "37", "38", "39", "40", "42", "43", "44", "45", "46", "47", "48"} : ToSubclass,read : ToSubclass] uint8 CategoryID;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 TypeID;

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpThreatDetection : BaseStatus

{

  [key,read : ToSubclass] string DetectionID;

  [key,read : ToSubclass] sint64 ThreatID;

  [read : ToSubclass] string ProcessName;

  [read : ToSubclass] string DomainUser;

  [ValueMap{"0", "1", "2", "3", "4", "5", "7", "8", "9"} : ToSubclass,read : ToSubclass] uint8 DetectionSourceTypeID;

  [read : ToSubclass] string Resources[];

  [read : ToSubclass] datetime InitialDetectionTime;

  [read : ToSubclass] datetime LastThreatStatusChangeTime;

  [read : ToSubclass] datetime RemediationTime;

  [ValueMap{"0", "1", "2", "3", "4"} : ToSubclass,read : ToSubclass] uint8 CurrentThreatExecutionStatusID;

  [ValueMap{"0", "1", "2", "3", "4", "5", "6", "Blocked", "102", "103", "104", "105", "107"} : ToSubclass,read : ToSubclass] uint8 ThreatStatusID;

  [read : ToSubclass] sint32 ThreatStatusErrorCode;

  [BitMap{"0", "1", "2", "3", "6", "8", "9", "10"} : ToSubclass,read : ToSubclass] uint8 CleaningActionID;

  [read : ToSubclass] string AMProductVersion = "";

  [read : ToSubclass] boolean ActionSuccess = FALSE;

  [ValueMap{"0", "4", "8", "12", "16", "20", "24", "28", "32768", "32772", "32776", "32780", "32784", "32788", "32792", "32796"} : ToSubclass,read : ToSubclass] uint32 AdditionalActionsBitMask;

};



[dynamic : ToInstance,provider("ProtectionManagement") : ToInstance,locale(1033)] 

class MSFT_MpWDOScan

{

  [implemented,static : ToSubclass DisableOverride] uint32 Start();

};