With the end of passive maintenance for Checkmk 2.3 approaching on October 29, 2026, we (and maybe many other admins) are preparing for the upgrade to Checkmk 2.4/2.5. However, we are facing a major roadblock regarding Microsoft Windows Defender monitoring.
Up until now, we heavily relied on the excellent plugins by Michael Dvorak (spit):
spit-defender-state– Mainly for monitoring the Quick Scan Age (time elapsed since the last quick scan).spit-defender-threads– For its deep Threat Detection capabilities, including extracting file paths, affected users, and most importantly, the ability to acknowledge/filter specific alerts via the WATO rule “Defender acknowledged threats” using Threat/Detection IDs.
Since both plugins still utilize the old Check API, they are probably completely broken and unusable under Checkmk 2.4/2.5.
The issue with current alternatives:
While there is the officially migrated plugin Windows Defender (win-defender-1) by jan-hendrikscholz available on the Exchange, it unfortunately does not cover all core requirements:
- There is no monitoring of
QuickScanEndTime(Quick Scan Age). - The entire threat history and the clever UI-driven acknowledgment feature for unique Threat IDs are completely missing.
Support, suggestions or alternatives from Community:
Nobody wants to go backwards by resorting to messy local PowerShell scripts or manual log parsing on the clients when we used to have such an elegant, native plugin architecture.
Therefore, we wanted to ask the community and especially the Python experts here:
- Has anyone already forked or migrated Michael Dvorak’s original plugins (
spit-defender-state/threads) to the Checkmk 2.5 API v1? - Alternatively, are there any ongoing efforts to integrate these missing parameters (QuickScan Age & Threat IDs) into the existing MKP by jan-hendrikscholz?
Any shared code snippets, unofficial 2.5-compatible MKPs, or guidance on this would be highly appreciated!
Best regards