KQL Search

Query Details

Software Evidence and Vulnerability Check

Software Evidence Vulnerability Check

Query

DeviceTvmSoftwareEvidenceBeta
| where SoftwareName contains "python"
| join kind=leftouter (
    DeviceTvmSoftwareVulnerabilities
    | project DeviceId, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel
) on DeviceId, SoftwareName, SoftwareVersion
| join kind=leftouter (
    DeviceInfo
    | summarize arg_max(Timestamp, DeviceName, OSPlatform) by DeviceId
) on DeviceId
| extend Vulnerable = iff(isnotempty(CveId), "Yes", "No")
| project
    DeviceName,
    OSPlatform,
    SoftwareName,
    SoftwareVersion,
    Vulnerable,
    CveId,
    VulnerabilitySeverityLevel,
    DiskPaths
| order by Vulnerable desc, DeviceName asc

About this query

Explanation

This query is designed to help you identify devices that have a specific software installed and determine if the version of that software has any known vulnerabilities according to Microsoft Defender Vulnerability Management. Here's a simplified breakdown of what the query does:

  1. Search for Software: It looks for devices with a particular software installed. In the example, it searches for "Python", but you can replace "Python" with any software name you want to check.

  2. Check for Vulnerabilities: It checks if the detected version of the software has any known vulnerabilities by looking up Common Vulnerabilities and Exposures (CVEs) in the DeviceTvmSoftwareVulnerabilities table.

  3. Gather Device Information: It retrieves the device name and operating system information from the DeviceInfo table.

  4. Determine Vulnerability Status: It marks the software as "Vulnerable" if a matching CVE is found. Otherwise, it marks it as "Not Vulnerable".

  5. Display Results: The output includes details such as the device name, operating system, software name and version, vulnerability status, CVE ID, severity level, and the disk paths where the software was found.

To use this query for other software, simply change the software name in the query. The query is flexible and can identify software names that contain additional product or version information. Keep in mind that the DeviceTvmSoftwareEvidenceBeta table is in beta, so its structure might change in the future.