MT.1163 - Signature Update Interval should be 1-4 hours

Overview

Checks that the signature update interval is configured between 1-4 hours in all assigned Microsoft Defender Antivirus policies.

Infrequent signature updates reduce detection of the latest threats, leaving endpoints vulnerable to newly discovered malware and exploits.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set Signature Update Interval to 1-4 hours

Related links

• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Test Metadata

Field	Value
Test ID	MT.1163
Severity	High
Suite	Maester
Category	Defender
PowerShell test	Test-MtMdeSignatureUpdateInterval
Tags	Defender, Maester, MT.1163

Source

• Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
• PowerShell source: powershell/public/maester/defender/Test-MtMdeSignatureUpdateInterval.ps1