OpenControls Logo

STIG Viewer

STIGViewer Support

Microsoft Defender AV must be configured to only send safe samples for MAPS telemetry.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-213435WNDF-AV-000011SV-213435r961092_ruleCCI-001170medium
Description
This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: (0x0) Always prompt (0x1) Send safe samples automatically (0x2) Never send (0x3) Send all samples automatically
STIGDate
Microsoft Defender Antivirus Security Technical Implementation Guide2026-05-08

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-03.3Explicitly Allow / Deny Applications
0.50
END-10Mobile Code
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SC-18(1)Identify Unacceptable Code and Take Corrective Actions
1.00
SC-18(3)Prevent Downloading and Execution
1.00
SC-18(4)Prevent Automatic Execution
1.00
CCI1 mapping
CCI-001170
1.00

Details

Check Text (C-213435r961092_chk)

This is applicable to unclassified systems. For other systems this is NA. Verify the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Send file samples when further analysis is required" is set to "Enabled" and "Send safe samples" is selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows Defender\Spynet Criteria: If the value "SubmitSamplesConsent" is REG_DWORD = 1, this is not a finding.

Fix Text (F-14658r823041_fix)

This is applicable to unclassified systems. For other systems this is NA. Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Microsoft Defender Antivirus >> MAPS >> "Send file samples when further analysis is required" to "Enabled" and select "Send safe samples" from the drop-down box.