MT.1168: Cleaned Malware should be retained for at least 30 days.

ID	MT.1168
Severity	Low
Suite	Mito
Product	Defender
Related products	Intune
Feature	Endpoint antivirus
Security area	Devices and endpoints
Resource type	Policy
User impact of fixing	Low
Effort to fix	Low
Reads from	Microsoft Graph

What this checks and how to fix it

Verify that cleaned malware is retained for at least 30 days to support forensic analysis and threat investigation.

Short retention may impact forensic analysis and threat investigation.

Remediation action:

1. Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
2. Edit the relevant Microsoft Defender Antivirus policy
3. Set Days to Retain Cleaned Malware to at least 30 days (recommended: 90 days)

Related links

• Configure Microsoft Defender Antivirus
• Microsoft Endpoint Manager

---

Mito check. Author: bdrogja. Open-source licences.