Update_310124

terraform/environments/ppud/cloudwatch_windows.tf

@@ -307,118 +307,106 @@ resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Started" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareScan-Started"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "An antimalware scan started."
+  pattern        = "Microsoft Defender Antivirus scan has started."
   metric_transformation {
     name      = "MalwareScan-Started"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Finished" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareScan-Finished"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "An antimalware scan finished."
+  pattern        = "Microsoft Defender Antivirus scan has finished."
   metric_transformation {
     name      = "MalwareScan-Finished"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Stopped" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareScan-Stopped"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "An antimalware scan was stopped before it finished."
+  pattern        = "Microsoft Defender Antivirus scan has been stopped before completion."
   metric_transformation {
     name      = "MalwareScan-Stopped"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareScan-Failed" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareScan-Failed"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "An antimalware scan failed."
+  pattern        = "Microsoft Defender Antivirus scan has failed."
   metric_transformation {
     name      = "MalwareScan-Failed"
     namespace = "WindowsDefender"
-    value     = "0"
-  }
-}
-
-resource "aws_cloudwatch_log_metric_filter" "Malware-Detected" {
-  count          = local.is-production == true ? 1 : 0
-  name           = "Malware-Detected"
-  log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "The antimalware engine found malware or other potentially unwanted software."
-  metric_transformation {
-    name      = "Malware-Detected"
-    namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareBehavior-Detected" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareBehavior-Detected"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "The antimalware platform detected suspicious behavior."
+  pattern        = "Microsoft Defender Antivirus detected a suspicious behavior."
   metric_transformation {
     name      = "MalwareBehavior-Detected"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareState-Detected" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareState-Detected"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "The antimalware platform detected malware or other potentially unwanted software."
+  pattern        = "Microsoft Defender Antivirus has detected malware or other potentially unwanted software."
   metric_transformation {
     name      = "MalwareState-Detected"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareSignatureUpdate-Failed" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareSignatureUpdate-Failed"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "The security intelligence update failed."
+  pattern        = "Microsoft Defender Antivirus has encountered an error trying to update security intelligence."
   metric_transformation {
     name      = "MalwareSignatureUpdate-Failed"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareEngineUpdate-Failed" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareEngineUpdate-Failed"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "The antimalware engine update failed."
+  pattern        = "Microsoft Defender Antivirus has encountered an error trying to update the engine."
   metric_transformation {
     name      = "MalwareEngineUpdate-Failed"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }
 
 resource "aws_cloudwatch_log_metric_filter" "MalwareEngineUpdate-OutofDate" {
   count          = local.is-production == true ? 1 : 0
   name           = "MalwareEngineUpdate-OutofDate"
   log_group_name = aws_cloudwatch_log_group.Windows-Defender-Logs[count.index].name
-  pattern        = "The antimalware engine failed to load because the antimalware platform is out of date."
+  pattern        = "Microsoft Defender Antivirus could not load antimalware engine because current platform version is not supported."
   metric_transformation {
     name      = "MalwareEngineUpdate-OutofDate"
     namespace = "WindowsDefender"
-    value     = "0"
+    value     = "1"
   }
 }