KQL Search

Query Details

Software Evidence and Vulnerability Check

Software Evidence Vulnerability Check

Query

DeviceTvmSoftwareEvidenceBeta
| where SoftwareName contains "python"
//Python is used as an example. 
//Replace python with the name of any software you want to investigate.
| join kind=leftouter (
    DeviceTvmSoftwareVulnerabilities
    | project DeviceId, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel
) on DeviceId, SoftwareName, SoftwareVersion
| join kind=leftouter (
    DeviceInfo
    | summarize arg_max(Timestamp, DeviceName, OSPlatform) by DeviceId
) on DeviceId
| extend Vulnerable = iff(isnotempty(CveId), "Yes", "No")
| project
    DeviceName,
    OSPlatform,
    SoftwareName,
    SoftwareVersion,
    Vulnerable,
    CveId,
    VulnerabilitySeverityLevel,
    DiskPaths
| order by Vulnerable desc, DeviceName asc

About this query

Explanation

This query is designed to help you identify devices with a specific software installed and check if that software version has any known vulnerabilities according to Microsoft Defender Vulnerability Management. Here's a simple breakdown of what the query does:

  1. Search for Software: It looks for devices that have a particular software installed. In the example, it searches for "python," but you can replace "python" with any software name you're interested in.

  2. Check for Vulnerabilities: It checks if the detected version of the software has any known vulnerabilities by looking for Common Vulnerabilities and Exposures (CVEs).

  3. Gather Device Information: It retrieves the device name and operating system details for each device where the software is found.

  4. Mark Vulnerability Status: It marks the software as "Vulnerable" if any matching CVEs are found. If no vulnerabilities are found, it marks it as "No."

  5. Display Results: It presents the results in a table showing the device name, operating system, software name and version, vulnerability status, CVE details, severity level, and the disk paths where the software was detected.

To search for a different software, simply change the part of the query that specifies "python" to the name of the software you're interested in. The query is flexible and can identify software names that include additional product or version information.

Keep in mind that if a software version is marked as "Vulnerable = No," it doesn't necessarily mean the software is completely secure; it just means no matching vulnerabilities were found in the database used by this query. Also, the table used in this query is in beta, so its structure might change in the future.