Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Where-Object { $_.TimeCreated -ge '2019-01-01 00:00:00' -and $_.Id -in 1006, 1015, 1116 }