KQL Search

Query Details

Device Vulnerability Prioritization CVSS EPSS

Query

// Define weights at the top of the query (must sum up to 1.0)
let CvssWeight = 0.35; // 1 = 100% / 0 = 0%
let EpssWeight = 0.65; // 1 = 100% / 0 = 0%
DeviceTvmSoftwareVulnerabilities
// Join with KB table to fetch CVSS and EPSS scores
| join kind=inner (
    DeviceTvmSoftwareVulnerabilitiesKB
    | project CveId, CvssScore = todouble(CvssScore), EpssScore = todouble(EpssScore)
) on CveId
// Join with DeviceInfo to get current OS details, MDE onboarding status, and LastSeen
| join kind=leftouter (
    DeviceInfo
    | summarize arg_max(Timestamp, OSPlatform, OSVersion, OnboardingStatus) by DeviceId
    | project DeviceId, LastSeen = Timestamp, OSPlatform, OSVersion, OnboardingStatus, IsMdeOnboarded = (OnboardingStatus == "Onboarded")
) on DeviceId
// Calculate weighted risk score using defined weights
| extend RiskScore = round((CvssScore * 10.0 * CvssWeight) + (EpssScore * 100.0 * EpssWeight), 1)
// Assign priority and patch SLA (days)
| extend SlaDays = case(
    RiskScore >= 65.0, 3,
    RiskScore >= 40.0, 14,
    RiskScore >= 20.0, 30,
    90
)
| extend Priority = case(
    RiskScore >= 65.0, "P1 - Critical",
    RiskScore >= 40.0, "P2 - High",
    RiskScore >= 20.0, "P3 - Medium",
    "P4 - Low"
)
// Calculate due date
| extend PatchDueDate = datetime_add('day', SlaDays, now())
| project 
    DeviceName, 
    DeviceId, 
    LastSeen,
    OSPlatform, 
    OSVersion, 
    OnboardingStatus, 
    IsMdeOnboarded, 
    SoftwareVendor, 
    SoftwareName, 
    SoftwareVersion, 
    CveId, 
    CvssScore, 
    EpssScore, 
    RiskScore, 
    Priority, 
    SlaDays, 
    PatchDueDate, 
    VulnerabilitySeverityLevel
| sort by RiskScore desc

About this query

Device-Vulnerability-Prioritization-CVSS-EPSS

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink

Description

This KQL query enriches vulnerability data from Defender for Endpoint by joining device inventory, operating system details, MDE onboarding status, and threat intelligence metrics. It correlates device vulnerabilities with CVSS severity and EPSS exploitability scores to prioritize patching based on actionable risk rather than static vulnerability levels.

The RiskScore is a weighted metric ranging from 0 to 100 that combines the technical severity of a vulnerability with its real world likelihood of exploitation. CVSS contributes 35 percent of the overall score to represent potential impact, while EPSS contributes 65 percent to heavily weight active exploitation probability.

Author <Optional>

References

Defender XDR

Explanation

This KQL query is designed to help prioritize which software vulnerabilities on devices should be patched first, based on their risk level. Here's a simple breakdown of what the query does:

  1. Data Gathering: It collects data about software vulnerabilities from Microsoft Defender for Endpoint, including details about the devices, their operating systems, and whether they are onboarded to Microsoft Defender.

  2. Vulnerability Scoring: It combines two scores to assess the risk of each vulnerability:

    • CVSS Score: Represents the potential impact of the vulnerability.
    • EPSS Score: Represents the likelihood of the vulnerability being exploited in the real world.

  3. Risk Score Calculation: The query calculates a "Risk Score" for each vulnerability, which ranges from 0 to 100. This score is a weighted combination of the CVSS and EPSS scores, with more emphasis (65%) on the likelihood of exploitation (EPSS) and less (35%) on the potential impact (CVSS).

  4. Priority Assignment: Based on the Risk Score, each vulnerability is assigned a priority level:

    • P1 - Critical: Risk Score 65 or above
    • P2 - High: Risk Score between 40 and 64
    • P3 - Medium: Risk Score between 20 and 39
    • P4 - Low: Risk Score below 20

  5. Patch Timeline: The query assigns a Service Level Agreement (SLA) for patching each vulnerability, ranging from 3 days for critical issues to 90 days for low-priority ones.

  6. Output: The query outputs a list of vulnerabilities sorted by their Risk Score, along with details like device information, software details, CVSS and EPSS scores, risk score, priority, and the due date for patching.

This approach helps organizations focus their patching efforts on vulnerabilities that pose the highest risk of exploitation, rather than just those with the highest technical severity.