MT.1168 - Cleaned Malware should be retained for at least 30 days

Overview

Verify that cleaned malware is retained for at least 30 days to support forensic analysis and threat investigation.

Short retention may impact forensic analysis and threat investigation.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set Days to Retain Cleaned Malware to at least 30 days (recommended: 90 days)

Related links

• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

Test Metadata

Field	Value
Test ID	MT.1168
Severity	High
Suite	Maester
Category	Defender
PowerShell test	Test-MtMdeRetainCleanedMalware
Tags	Defender, Maester, MT.1168

Source

• Pester test: tests/Maester/Defender/Test-MtMdeAntivirusPolicy.Tests.ps1
• PowerShell source: powershell/public/maester/defender/Test-MtMdeRetainCleanedMalware.ps1