Now called Windows Defender Antivirus cloud protection, it includes key telemetry events.
Microsoft describes it as:
The Microsoft Active Protection Service is the cloud service that enables:
- Clients to report key telemetry events and suspicious malware queries to the cloud
- Cloud to provide real-time blocking responses back to the client