microsoft.graph.windowsProtectionState

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-intune/json-schema/microsoft-intune-microsoft-graph-windows-protection-state-schema.json",
  "title": "microsoft.graph.windowsProtectionState",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-intune-openapi.yml#/components/schemas/microsoft.graph.windowsProtectionState",
  "allOf": [
    {
      "$ref": "#/$defs/microsoft.graph.entity"
    },
    {
      "title": "windowsProtectionState",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "antiMalwareVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Current anti malware version"
        },
        "controlledConfigurationEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates the Windows Defender controlled configuration feature is enabled, when FALSE indicates the Windows Defender controlled configuration feature is not enabled. Defaults to setting on client device."
        },
        "deviceState": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.windowsDeviceHealthState"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Indicates device's health state. The possible values are: clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical. The possible values are: clean, fullScanPending, rebootPending, manualStepsPending, offlineScanPending, critical."
        },
        "engineVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Current endpoint protection engine's version"
        },
        "fullScanOverdue": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates full scan is overdue, when FALSE indicates full scan is not overdue. Defaults to setting on client device."
        },
        "fullScanRequired": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates full scan is required, when FALSE indicates full scan is not required. Defaults to setting on client device."
        },
        "isVirtualMachine": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates the device is a virtual machine, when FALSE indicates the device is not a virtual machine. Defaults to setting on client device."
        },
        "lastFullScanDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "Last quick scan datetime",
          "format": "date-time"
        },
        "lastFullScanSignatureVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Last full scan signature version"
        },
        "lastQuickScanDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "Last quick scan datetime",
          "format": "date-time"
        },
        "lastQuickScanSignatureVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Last quick scan signature version"
        },
        "lastReportedDateTime": {
          "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
          "type": [
            "string",
            "null"
          ],
          "description": "Last device health status reported time",
          "format": "date-time"
        },
        "malwareProtectionEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates anti malware is enabled when FALSE indicates anti malware is not enabled."
        },
        "networkInspectionSystemEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates network inspection system enabled, when FALSE indicates network inspection system is not enabled. Defaults to setting on client device."
        },
        "productStatus": {
          "anyOf": [
            {
              "$ref": "#/$defs/microsoft.graph.windowsDefenderProductStatus"
            },
            {
              "type": [
                "object",
                "null"
              ]
            }
          ],
          "description": "Product Status of Windows Defender Antivirus. The possible values are: noStatus, serviceNotRunning, serviceStartedWithoutMalwareProtection, pendingFullScanDueToThreatAction, pendingRebootDueToThreatAction, pendingManualStepsDueToThreatAction, avSignaturesOutOfDate, asSignaturesOutOfDate, noQuickScanHappenedForSpecifiedPeriod, noFullScanHappenedForSpecifiedPeriod, systemInitiatedScanInProgress, systemInitiatedCleanInProgress, samplesPendingSubmission, productRunningInEvaluationMode, productRunningInNonGenuineMode, productExpired, offlineScanRequired, serviceShutdownAsPartOfSystemShutdown, threatRemediationFailedCritically, threatRemediationFailedNonCritically, noStatusFlagsSet, platformOutOfDate, platformUpdateInProgress, platformAboutToBeOutdated, signatureOrPlatformEndOfLifeIsPastOrIsImpending, windowsSModeSignaturesInUseOnNonWin10SInstall. The possible values are: noStatus, serviceNotRunning, serviceStartedWithoutMalwareProtection, pendingFullScanDueToThreatAction, pendingRebootDueToThreatAction, pendingManualStepsDueToThreatAction, avSignaturesOutOfDate, asSignaturesOutOfDate, noQuickScanHappenedForSpecifiedPeriod, noFullScanHappenedForSpecifiedPeriod, systemInitiatedScanInProgress, systemInitiatedCleanInProgress, samplesPendingSubmission, productRunningInEvaluationMode, productRunningInNonGenuineMode, productExpired, offlineScanRequired, serviceShutdownAsPartOfSystemShutdown, threatRemediationFailedCritically, threatRemediationFailedNonCritically, noStatusFlagsSet, platformOutOfDate, platformUpdateInProgress, platformAboutToBeOutdated, signatureOrPlatformEndOfLifeIsPastOrIsImpending, windowsSModeSignaturesInUseOnNonWin10SInstall."
        },
        "quickScanOverdue": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates quick scan is overdue, when FALSE indicates quick scan is not overdue. Defaults to setting on client device."
        },
        "realTimeProtectionEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates real time protection is enabled, when FALSE indicates real time protection is not enabled. Defaults to setting on client device."
        },
        "rebootRequired": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates reboot is required, when FALSE indicates when TRUE indicates reboot is not required. Defaults to setting on client device."
        },
        "signatureUpdateOverdue": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates signature is out of date, when FALSE indicates signature is not out of date. Defaults to setting on client device."
        },
        "signatureVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "Current malware definitions version"
        },
        "tamperProtectionEnabled": {
          "type": [
            "boolean",
            "null"
          ],
          "description": "When TRUE indicates the Windows Defender tamper protection feature is enabled, when FALSE indicates the Windows Defender tamper protection feature is not enabled. Defaults to setting on client device."
        },
        "detectedMalwareState": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/microsoft.graph.windowsDeviceMalwareState"
          },
          "description": "Device malware list",
          "x-ms-navigationProperty": true
        },
        "@odata.type": {
          "type": "string"
        }
      },
      "description": "Device protection status entity."
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.windowsProtectionState",
  "$defs": {
    "microsoft.graph.entity": {
      "title": "entity",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "The unique identifier for an entity. Read-only."
        },
        "@odata.type": {
          "type": "string"
        }
      }
    },
    "microsoft.graph.windowsDefenderProductStatus": {
      "title": "windowsDefenderProductStatus",
      "enum": [
        "noStatus",
        "serviceNotRunning",
        "serviceStartedWithoutMalwareProtection",
        "pendingFullScanDueToThreatAction",
        "pendingRebootDueToThreatAction",
        "pendingManualStepsDueToThreatAction",
        "avSignaturesOutOfDate",
        "asSignaturesOutOfDate",
        "noQuickScanHappenedForSpecifiedPeriod",
        "noFullScanHappenedForSpecifiedPeriod",
        "systemInitiatedScanInProgress",
        "systemInitiatedCleanInProgress",
        "samplesPendingSubmission",
        "productRunningInEvaluationMode",
        "productRunningInNonGenuineMode",
        "productExpired",
        "offlineScanRequired",
        "serviceShutdownAsPartOfSystemShutdown",
        "threatRemediationFailedCritically",
        "threatRemediationFailedNonCritically",
        "noStatusFlagsSet",
        "platformOutOfDate",
        "platformUpdateInProgress",
        "platformAboutToBeOutdated",
        "signatureOrPlatformEndOfLifeIsPastOrIsImpending",
        "windowsSModeSignaturesInUseOnNonWin10SInstall"
      ],
      "type": "string",
      "description": "Product Status of Windows Defender",
      "x-ms-enum-flags": {
        "isFlags": true
      },
      "x-ms-enum": {
        "name": "windowsDefenderProductStatus",
        "modelAsString": false,
        "values": [
          {
            "value": "noStatus",
            "description": "No status",
            "name": "noStatus"
          },
          {
            "value": "serviceNotRunning",
            "description": "Service not running",
            "name": "serviceNotRunning"
          },
          {
            "value": "serviceStartedWithoutMalwareProtection",
            "description": "Service started without any malware protection engine",
            "name": "serviceStartedWithoutMalwareProtection"
          },
          {
            "value": "pendingFullScanDueToThreatAction",
            "description": "Pending full scan due to threat action",
            "name": "pendingFullScanDueToThreatAction"
          },
          {
            "value": "pendingRebootDueToThreatAction",
            "description": "Pending reboot due to threat action",
            "name": "pendingRebootDueToThreatAction"
          },
          {
            "value": "pendingManualStepsDueToThreatAction",
            "description": "Pending manual steps due to threat action",
            "name": "pendingManualStepsDueToThreatAction"
          },
          {
            "value": "avSignaturesOutOfDate",
            "description": "Antivirus (AV) signatures out of date",
            "name": "avSignaturesOutOfDate"
          },
          {
            "value": "asSignaturesOutOfDate",
            "description": "Antisypware (AS) signatures out of date",
            "name": "asSignaturesOutOfDate"
          },
          {
            "value": "noQuickScanHappenedForSpecifiedPeriod",
            "description": "No quick scan has happened for a specified period",
            "name": "noQuickScanHappenedForSpecifiedPeriod"
          },
          {
            "value": "noFullScanHappenedForSpecifiedPeriod",
            "description": "No full scan has happened for a specified period",
            "name": "noFullScanHappenedForSpecifiedPeriod"
          },
          {
            "value": "systemInitiatedScanInProgress",
            "description": "System initiated scan in progress",
            "name": "systemInitiatedScanInProgress"
          },
          {
            "value": "systemInitiatedCleanInProgress",
            "description": "System initiated clean in progress",
            "name": "systemInitiatedCleanInProgress"
          },
          {
            "value": "samplesPendingSubmission",
            "description": "There are samples pending submission",
            "name": "samplesPendingSubmission"
          },
          {
            "value": "productRunningInEvaluationMode",
            "description": "Product running in evaluation mode",
            "name": "productRunningInEvaluationMode"
          },
          {
            "value": "productRunningInNonGenuineMode",
            "description": "Product running in non-genuine Windows mode",
            "name": "productRunningInNonGenuineMode"
          },
          {
            "value": "productExpired",
            "description": "Product expired",
            "name": "productExpired"
          },
          {
            "value": "offlineScanRequired",
            "description": "Off-line scan required",
            "name": "offlineScanRequired"
          },
          {
            "value": "serviceShutdownAsPartOfSystemShutdown",
            "description": "Service is shutting down as part of system shutdown",
            "name": "serviceShutdownAsPartOfSystemShutdown"
          },
          {
            "value": "threatRemediationFailedCritically",
            "description": "Threat remediation failed critically",
            "name": "threatRemediationFailedCritically"
          },
          {
            "value": "threatRemediationFailedNonCritically",
            "description": "Threat remediation failed non-critically",
            "name": "threatRemediationFailedNonCritically"
          },
          {
            "value": "noStatusFlagsSet",
            "description": "No status flags set (well initialized state)",
            "name": "noStatusFlagsSet"
          },
          {
            "value": "platformOutOfDate",
            "description": "Platform is out of date",
            "name": "platformOutOfDate"
          },
          {
            "value": "platformUpdateInProgress",
            "description": "Platform update is in progress",
            "name": "platformUpdateInProgress"
          },
          {
            "value": "platformAboutToBeOutdated",
            "description": "Platform is about to be outdated",
            "name": "platformAboutToBeOutdated"
          },
          {
            "value": "signatureOrPlatformEndOfLifeIsPastOrIsImpending",
            "description": "Signature or platform end of life is past or is impending",
            "name": "signatureOrPlatformEndOfLifeIsPastOrIsImpending"
          },
          {
            "value": "windowsSModeSignaturesInUseOnNonWin10SInstall",
            "description": "Windows SMode signatures still in use on non-Win10S install",
            "name": "windowsSModeSignaturesInUseOnNonWin10SInstall"
          }
        ]
      }
    },
    "microsoft.graph.windowsDeviceHealthState": {
      "title": "windowsDeviceHealthState",
      "enum": [
        "clean",
        "fullScanPending",
        "rebootPending",
        "manualStepsPending",
        "offlineScanPending",
        "critical"
      ],
      "type": "string",
      "description": "Computer endpoint protection state",
      "x-ms-enum-flags": {
        "isFlags": true
      },
      "x-ms-enum": {
        "name": "windowsDeviceHealthState",
        "modelAsString": false,
        "values": [
          {
            "value": "clean",
            "description": "Computer is clean and no action is required",
            "name": "clean"
          },
          {
            "value": "fullScanPending",
            "description": "Computer is in pending full scan state",
            "name": "fullScanPending"
          },
          {
            "value": "rebootPending",
            "description": "Computer is in pending reboot state",
            "name": "rebootPending"
          },
          {
            "value": "manualStepsPending",
            "description": "Computer is in pending manual steps state",
            "name": "manualStepsPending"
          },
          {
            "value": "offlineScanPending",
            "description": "Computer is in pending offline scan state",
            "name": "offlineScanPending"
          },
          {
            "value": "critical",
            "description": "Computer is in critical failure state",
            "name": "critical"
          }
        ]
      }
    },
    "microsoft.graph.windowsDeviceMalwareState": {
      "allOf": [
        {
          "$ref": "#/$defs/microsoft.graph.entity"
        },
        {
          "title": "windowsDeviceMalwareState",
          "required": [
            "@odata.type"
          ],
          "type": "object",
          "properties": {
            "additionalInformationUrl": {
              "type": [
                "string",
                "null"
              ],
              "description": "Information URL to learn more about the malware"
            },
            "category": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.windowsMalwareCategory"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Category of the malware. The possible values are: invalid, adware, spyware, passwordStealer, trojanDownloader, worm, backdoor, remoteAccessTrojan, trojan, emailFlooder, keylogger, dialer, monitoringSoftware, browserModifier, cookie, browserPlugin, aolExploit, nuker, securityDisabler, jokeProgram, hostileActiveXControl, softwareBundler, stealthNotifier, settingsModifier, toolBar, remoteControlSoftware, trojanFtp, potentialUnwantedSoftware, icqExploit, trojanTelnet, exploit, filesharingProgram, malwareCreationTool, remoteControlSoftware, tool, trojanDenialOfService, trojanDropper, trojanMassMailer, trojanMonitoringSoftware, trojanProxyServer, virus, known, unknown, spp, behavior, vulnerability, policy, enterpriseUnwantedSoftware, ransom, hipsRule."
            },
            "detectionCount": {
              "maximum": 2147483647,
              "minimum": -2147483648,
              "type": [
                "number",
                "null"
              ],
              "description": "Number of times the malware is detected",
              "format": "int32"
            },
            "displayName": {
              "type": [
                "string",
                "null"
              ],
              "description": "Malware name"
            },
            "executionState": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.windowsMalwareExecutionState"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Execution status of the malware like blocked/executing etc. The possible values are: unknown, blocked, allowed, running, notRunning."
            },
            "initialDetectionDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "Initial detection datetime of the malware",
              "format": "date-time"
            },
            "lastStateChangeDateTime": {
              "pattern": "^[0-9]{4,}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]([.][0-9]{1,12})?(Z|[+-][0-9][0-9]:[0-9][0-9])$",
              "type": [
                "string",
                "null"
              ],
              "description": "The last time this particular threat was changed",
              "format": "date-time"
            },
            "severity": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.windowsMalwareSeverity"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Severity of the malware. The possible values are: unknown, low, moderate, high, severe."
            },
            "state": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.windowsMalwareState"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: unknown, detected, cleaned, quarantined, removed, allowed, blocked, cleanFailed, quarantineFailed, removeFailed, allowFailed, abandoned, blockFailed."
            },
            "threatState": {
              "anyOf": [
                {
                  "$ref": "#/$defs/microsoft.graph.windowsMalwareThreatState"
                },
                {
                  "type": [
                    "object",
                    "null"
                  ]
                }
              ],
              "description": "Current status of the malware like cleaned/quarantined/allowed etc. The possible values are: active, actionFailed, manualStepsRequired, fullScanRequired, rebootRequired, remediatedWithNonCriticalFailures, quarantined, removed, cleaned, allowed, noStatusCleared."
            },
            "@odata.type": {
              "type": "string"
            }
          },
          "description": "Malware detection entity."
        }
      ],
      "x-ms-discriminator-value": "#microsoft.graph.windowsDeviceMalwareState"
    },
    "microsoft.graph.windowsMalwareCategory": {
      "title": "windowsMalwareCategory",
      "enum": [
        "invalid",
        "adware",
        "spyware",
        "passwordStealer",
        "trojanDownloader",
        "worm",
        "backdoor",
        "remoteAccessTrojan",
        "trojan",
        "emailFlooder",
        "keylogger",
        "dialer",
        "monitoringSoftware",
        "browserModifier",
        "cookie",
        "browserPlugin",
        "aolExploit",
        "nuker",
        "securityDisabler",
        "jokeProgram",
        "hostileActiveXControl",
        "softwareBundler",
        "stealthNotifier",
        "settingsModifier",
        "toolBar",
        "remoteControlSoftware",
        "trojanFtp",
        "potentialUnwantedSoftware",
        "icqExploit",
        "trojanTelnet",
        "exploit",
        "filesharingProgram",
        "malwareCreationTool",
        "remote_Control_Software",
        "tool",
        "trojanDenialOfService",
        "trojanDropper",
        "trojanMassMailer",
        "trojanMonitoringSoftware",
        "trojanProxyServer",
        "virus",
        "known",
        "unknown",
        "spp",
        "behavior",
        "vulnerability",
        "policy",
        "enterpriseUnwantedSoftware",
        "ransom",
        "hipsRule"
      ],
      "type": "string",
      "description": "Malware category id",
      "x-ms-enum": {
        "name": "windowsMalwareCategory",
        "modelAsString": false,
        "values": [
          {
            "value": "invalid",
            "description": "Invalid",
            "name": "invalid"
          },
          {
            "value": "adware",
            "description": "Adware",
            "name": "adware"
          },
          {
            "value": "spyware",
            "description": "Spyware",
            "name": "spyware"
          },
          {
            "value": "passwordStealer",
            "description": "Password stealer",
            "name": "passwordStealer"
          },
          {
            "value": "trojanDownloader",
            "description": "Trojan downloader",
            "name": "trojanDownloader"
          },
          {
            "value": "worm",
            "description": "Worm",
            "name": "worm"
          },
          {
            "value": "backdoor",
            "description": "Backdoor",
            "name": "backdoor"
          },
          {
            "value": "remoteAccessTrojan",
            "description": "Remote access Trojan",
            "name": "remoteAccessTrojan"
          },
          {
            "value": "trojan",
            "description": "Trojan",
            "name": "trojan"
          },
          {
            "value": "emailFlooder",
            "description": "Email flooder",
            "name": "emailFlooder"
          },
          {
            "value": "keylogger",
            "description": "Keylogger",
            "name": "keylogger"
          },
          {
            "value": "dialer",
            "description": "Dialer",
            "name": "dialer"
          },
          {
            "value": "monitoringSoftware",
            "description": "Monitoring software",
            "name": "monitoringSoftware"
          },
          {
            "value": "browserModifier",
            "description": "Browser modifier",
            "name": "browserModifier"
          },
          {
            "value": "cookie",
            "description": "Cookie",
            "name": "cookie"
          },
          {
            "value": "browserPlugin",
            "description": "Browser plugin",
            "name": "browserPlugin"
          },
          {
            "value": "aolExploit",
            "description": "AOL exploit",
            "name": "aolExploit"
          },
          {
            "value": "nuker",
            "description": "Nuker",
            "name": "nuker"
          },
          {
            "value": "securityDisabler",
            "description": "Security disabler",
            "name": "securityDisabler"
          },
          {
            "value": "jokeProgram",
            "description": "Joke program",
            "name": "jokeProgram"
          },
          {
            "value": "hostileActiveXControl",
            "description": "Hostile ActiveX control",
            "name": "hostileActiveXControl"
          },
          {
            "value": "softwareBundler",
            "description": "Software bundler",
            "name": "softwareBundler"
          },
          {
            "value": "stealthNotifier",
            "description": "Stealth modifier",
            "name": "stealthNotifier"
          },
          {
            "value": "settingsModifier",
            "description": "Settings modifier",
            "name": "settingsModifier"
          },
          {
            "value": "toolBar",
            "description": "Toolbar",
            "name": "toolBar"
          },
          {
            "value": "remoteControlSoftware",
            "description": "Remote control software",
            "name": "remoteControlSoftware"
          },
          {
            "value": "trojanFtp",
            "description": "Trojan FTP",
            "name": "trojanFtp"
          },
          {
            "value": "potentialUnwantedSoftware",
            "description": "Potential unwanted software",
            "name": "potentialUnwantedSoftware"
          },
          {
            "value": "icqExploit",
            "description": "ICQ exploit",
            "name": "icqExploit"
          },
          {
            "value": "trojanTelnet",
            "description": "Trojan telnet",
            "name": "trojanTelnet"
          },
          {
            "value": "exploit",
            "description": "Exploit",
            "name": "exploit"
          },
          {
            "value": "filesharingProgram",
            "description": "File sharing program",
            "name": "filesharingProgram"
          },
          {
            "value": "malwareCreationTool",
            "description": "Malware creation tool",
            "name": "malwareCreationTool"
          },
          {
            "value": "remote_Control_Software",
            "description": "Remote control software",
            "name": "remote_Control_Software"
          },
          {
            "value": "tool",
            "description": "Tool",
            "name": "tool"
          },
          {
            "value": "trojanDenialOfService",
            "description": "Trojan denial of service",
            "name": "trojanDenialOfService"
          },
          {
            "value": "trojanDropper",
            "description": "Trojan dropper",
            "name": "trojanDropper"
          },
          {
            "value": "trojanMassMailer",
            "description": "Trojan mass mailer",
            "name": "trojanMassMailer"
          },
          {
            "value": "trojanMonitoringSoftware",
            "description": "Trojan monitoring software",
            "name": "trojanMonitoringSoftware"
          },
          {
            "value": "trojanProxyServer",
            "description": "Trojan proxy server",
            "name": "trojanProxyServer"
          },
          {
            "value": "virus",
            "description": "Virus",
            "name": "virus"
          },
          {
            "value": "known",
            "description": "Known",
            "name": "known"
          },
          {
            "value": "unknown",
            "description": "Unknown",
            "name": "unknown"
          },
          {
            "value": "spp",
            "description": "SPP",
            "name": "spp"
          },
          {
            "value": "behavior",
            "description": "Behavior",
            "name": "behavior"
          },
          {
            "value": "vulnerability",
            "description": "Vulnerability",
            "name": "vulnerability"
          },
          {
            "value": "policy",
            "description": "Policy",
            "name": "policy"
          },
          {
            "value": "enterpriseUnwantedSoftware",
            "description": "Enterprise Unwanted Software",
            "name": "enterpriseUnwantedSoftware"
          },
          {
            "value": "ransom",
            "description": "Ransom",
            "name": "ransom"
          },
          {
            "value": "hipsRule",
            "description": "HIPS Rule",
            "name": "hipsRule"
          }
        ]
      }
    },
    "microsoft.graph.windowsMalwareExecutionState": {
      "title": "windowsMalwareExecutionState",
      "enum": [
        "unknown",
        "blocked",
        "allowed",
        "running",
        "notRunning"
      ],
      "type": "string",
      "description": "Malware execution status",
      "x-ms-enum": {
        "name": "windowsMalwareExecutionState",
        "modelAsString": false,
        "values": [
          {
            "value": "unknown",
            "description": "Unknown",
            "name": "unknown"
          },
          {
            "value": "blocked",
            "description": "Blocked",
            "name": "blocked"
          },
          {
            "value": "allowed",
            "description": "Allowed",
            "name": "allowed"
          },
          {
            "value": "running",
            "description": "Running",
            "name": "running"
          },
          {
            "value": "notRunning",
            "description": "Not running",
            "name": "notRunning"
          }
        ]
      }
    },
    "microsoft.graph.windowsMalwareSeverity": {
      "title": "windowsMalwareSeverity",
      "enum": [
       

# --- truncated at 32 KB (37 KB total) ---
# Full source: https://artifacts.apis.io/microsoft-intune/json-schema/microsoft-intune-microsoft-graph-windows-protection-state-schema.json