EXPLORE
← Back to Explore
kqlHunting

Device EDR settings are not compliant

----

Detection Query

DeviceTvmSecureConfigurationAssessment
| join kind=inner DeviceTvmSecureConfigurationAssessmentKB on ConfigurationId
| where IsCompliant == 0 and IsApplicable == 1
| where ConfigurationSubcategory == "EDR"

Platforms

microsoft-defender

Tags

vulnerability-management
Raw Content
# Device EDR settings are not compliant
----
## Defender XDR
```KQL
DeviceTvmSecureConfigurationAssessment
| join kind=inner DeviceTvmSecureConfigurationAssessmentKB on ConfigurationId
| where IsCompliant == 0 and IsApplicable == 1
| where ConfigurationSubcategory == "EDR"
```