Microsoft Defender Advanced hunting KQL Query

136 views Asked by At

Im looking to export a list of all apps with CVE's from Advanced Hunting, I have a Query that exports a list of apps per device but it currently list each apps multiple times per device if multiple CVE's found, is there a way to limit this to just on app per device.

This is the query I have so far.

union DeviceTvmSoftwareInventory, DeviceTvmSoftwareVulnerabilities, DeviceTvmSoftwareVulnerabilitiesKB | where OSPlatform =="macOS" | where CveId != "" | summarize take_any(SoftwareName by DeviceName, DeviceId, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, CveMitigationStatus, CvssScore) | sort by CvssScore

0

There are 0 answers