This KQL query is designed to identify and list risky assets within the Defender External Attack Surface Management system. Here's a simplified breakdown of what each part of the query does:

1. Finding High Severity Risky Assets (Last 7 Days):

   • The first part of the query filters the EasmRisk_CL table to find assets that have been seen in the last 7 days (AssetLastSeen_t >= ago(7d)) and are categorized as "High Severity" (CategoryName_s == "High Severity").
   • It then extracts the rule associated with each asset from the AssetDiscoveryAuditTrail_s field and converts it to a string.
   • Finally, it selects and displays the following columns: TimeGenerated, AssetType_s, AssetName_s, CategoryName_s, and the extracted Rule.

2. Listing All Risky Assets (Last 180 Days):

   • The second part of the query retrieves all risky assets from the EasmRisk_CL table that have been generated in the last 180 days (TimeGenerated > ago(180d)).
   • It extends the data with additional fields for clarity:
     • Severity is set to the value of CategoryName_s.
     • Description is set to the value of MetricDisplayName_s.
     • AssetType and AssetName are directly taken from their respective fields.
     • Depending on the AssetType, it assigns the AssetName to specific fields such as IPAddress, Host, Page, Domain, or SSLCert.
   • The query then projects a list of columns to display: TimeGenerated, Severity, Description, AssetType, AssetName, IPAddress, Host, Domain, SSLCert, Page, and AssetUuid_g.

In summary, these queries help identify and list risky assets by their severity and type, providing detailed information about each asset's characteristics and when they were last seen or generated.