Get Symantec Endpoint Protection AV Status for use with Science Logic Monitoring

Get-SymantecEndpointStatus.ps1

<#
Get Symantec Endpoint Protection AV Status for use with Science Logic Monitoring
Auth: jfrmilner
#>
$version = Get-ItemProperty -Path 'HKLM:SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion'
#version check for dat path. Tested with v12 and v14 only.
if ($version.PRODUCTVERSION -match "^12\.") {
    $path = (Get-ItemProperty -Path 'HKLM:SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\' -Name DEFWATCH_10).DEFWATCH_10
}
else {
    $path = (Get-ItemProperty -Path 'HKLM:SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs\SDSDefs' -Name DEFWATCH_10).DEFWATCH_10
}

$writeTime = Get-ItemProperty -Path $path -Name LastWriteTime
$timeSpan = New-TimeSpan -Start $writeTime.LastWriteTime

$result = New-Object PSObject -Property @{
    'Name'       = $version.PRODUCTNAME
    'Version'    = $version.PRODUCTVERSION
    'WriteTime'  = $writeTime.LastWriteTime.ToUniversalTime()
    'Days'       = $timeSpan.Days
    'Definition' = $path.Split('\')[-1]
}

Write-Output $result