GetRealTimeProtectionState

Will determine if the product is currently providing real time protection.
If Windows SecurityCenter is enabled and the product reports to SecurityCenter then this method is implemented even if the product does not explicitly state that it is implemented.

Syntax

Method ID

#define WAAPI_MID_GET_RTP_STATE 1000

JSON Input Structure

{
  "input": {
    "method": 1000,
    "signature": number,
    "skip_connection_check": boolean
  }
}

Input Properties

Parameter	Type	Description
`skip_connection_check`	boolean	(optional) If true, it will not check the internet connection on the endpoint. Default value is false.

JSON Output Structure

{
  "result": {
    "method": 1000,
    "code": number,
    "timing": number,
    "timestamp": string,
    "enabled": boolean,
    "state": string,
    "has_internet_connectivity": boolean,
    "details": {
      "antivirus": boolean,
      "antispyware": boolean,
      "other": [
        {
          "name": string,
          "state": boolean
        },
        ...
      ]
    },
    "managed_by_3rd_party_products": [
      {
        "product_name": string,
        "remediation_path": string,
        "signature": number
      },
      ...
    ]
  }
}

Output Properties

Property	Type	Description
`result.method`	number	The method ID that generated this result.
`result.code`	number	The result code. See Result Codes.
`result.timing`	number	The measured time for the method call in milliseconds.
`result.timestamp`	string	The timestamp in seconds of when the call was made.
`result.enabled`	boolean	True if all forms of real time protection are enabled.
`result.state`	string	(optional) (Windows only) The state of real time protection. `enabled`: RTP is active (pairs with enabled:true). `disabled`: RTP is off, or its check reports it as not active (pairs with enabled:false). `initializing`: the product's RTP component(s) are still starting up and haven't reached a steady state yet, e.g. a backing Windows service in START_PENDING (pairs with enabled:false). `unknown`: the SDK couldn't determine the current state due to a transient check failure, e.g. a service-state query error (pairs with enabled:false). Note (Trend Micro Apex One Security Agent only): during very early boot, a fully-stopped RTP service that has not yet reached a starting state may be reported as `disabled` even though it is only initializing; callers should retry briefly during the boot window rather than treating an early `disabled` as final.
`result.has_internet_connectivity`	boolean	(optional) (EDR products only) Will return the internet connectivity of this product. Will be disappeared when flag skip_connection_check is enabled.
`result.details`	object	Will contain a key for each form of protection, named by type and whether it was enabled.
`result.details.antivirus`	boolean	(optional) Indicates if the RTP antivirus based protection is being provided. Will not be present if the RTP does not contain antivirus capabilities.
`result.details.antispyware`	boolean	(optional) Indicates if the RTP antispyware based protection is being provided. Will not be present if the RTP does not contain antispyware capabilities.
`result.details.other`	array<object>	(optional) Will contain a key for each form of additional protection (besides antivirus and antispyware). Will not be present if the product does not contain additional protection component.
`result.details.other.name`	string	(optional) Additional protection component name.
`result.details.other.state`	boolean	(optional) Indicates if the additional component protection is being provided.
`result.managed_by_3rd_party_products`	array<object>	(optional) (Windows Defender only) An array of information about third party products manage Windows Defender.
`result.managed_by_3rd_party_products.product_name`	string	(optional) (Windows Defender only) The name of third party products manage Windows Defender.
`result.managed_by_3rd_party_products.remediation_path`	string	(optional) (Windows Defender only) The path of third party products manage Windows Defender.
`result.managed_by_3rd_party_products.signature`	number	(optional) (Windows Defender only) The signature of third party products manage Windows Defender.

Result Codes

Code	Name	Description
0	`WAAPI_OK`	The operation completed successfully.

note

Other codes may be returned. See the full Result Codes reference for the complete list.

Remarks

Error Handling

The results of this function are determined by the error code returned by the call. If successful, WAAPI_OK or a special success code will be returned. Always check both the function return value and the result.code field in the output JSON.

Examples

Examples will be added here demonstrating the usage of this method.

Syntax​

Method ID​

JSON Input Structure​

Input Properties​

JSON Output Structure​

Output Properties​

Result Codes​

Remarks​

Error Handling​

Examples​

See Also​