Windows Intelligence Update

[Geezy]

Someone showed me this and I did not know what to think. I spent some time looking on the web but the only conclusive thing I found is that this is different than "Security Intelligence Updates" which are related to malware, because they are listed separately and under a different name.

Maybe someone here will have some answers, I would appreciate the information.

What is Windows Intelligence?

What do the updates do?

In the Update History, why is there no "Learn More" link next to these updates?

Why is Windows Intelligence not listed in "Installed apps"?

[Xenon]

From what I understand it has to do with the detection of malware. It is not a definitions update. 

 

https://answers.microsoft.com/en-us/insider/forum/all/windows-intelligence-update/29f6f4b3-a049-49ec-bec3-8a200332fbcf

[Geezy]

On 03/11/2023 at 13:13, Xenon said:

From what I understand it has to do with the detection of malware. It is not a definitions update. 

 

https://answers.microsoft.com/en-us/insider/forum/all/windows-intelligence-update/29f6f4b3-a049-49ec-bec3-8a200332fbcf

From what I see in that discussion, the intelligence updates are part of the Security Intelligence Update and not the Windows Intelligence Update.

In any case, the linked discussion looks like people who are also searching for answers and there is no official conclusive answer.

From the linked discussion:

"Looks like other users have the same question about what Windows Intelligence Update does, but nobody got an answer from MS."

[goretsky Supervisor]

Hello,

At a complete guess, probably an update to detect non-malware threats.  Examples of this could include IP addresses being used by known malicious actors, exploits for CVEs (not malware containing them, but the exploits itself), updates to HIPS, NIDS and/or firewall rules, and so forth.

Regards,

Aryeh Goretsky
 

[Geezy]

On 05/11/2023 at 01:45, goretsky said:

Hello,

At a complete guess, probably an update to detect non-malware threats.  Examples of this could include IP addresses being used by known malicious actors, exploits for CVEs (not malware containing them, but the exploits itself), updates to HIPS, NIDS and/or firewall rules, and so forth.

Regards,

Aryeh Goretsky
 

That seems plausible. If only there was a "Learn more" link next to the update. It's the only update I have noticed that doesn't have such a link.