MT.1163: Signature Update Interval should be 1-4 hours.
| ID | MT.1163 |
| Severity | Low |
| Suite | Mito |
| Product | Defender |
| Related products | Intune |
| Feature | Endpoint antivirus |
| Security area | Devices and endpoints |
| Resource type | Policy |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-3 Malicious Code Protection |
| MITRE ATT&CK | T1204.002 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Checks that the signature update interval is configured between 1-4 hours in all assigned Microsoft Defender Antivirus policies.
Infrequent signature updates reduce detection of the latest threats, leaving endpoints vulnerable to newly discovered malware and exploits.
Remediation action:
Section titled “Remediation action:”- Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
- Edit the relevant Microsoft Defender Antivirus policy
- Set Signature Update Interval to 1-4 hours
Related links
Section titled “Related links”Mito check. Author: bdrogja. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.