kqlHunting

Device congifuration not compliant

----

Detection Query

DeviceTvmSecureConfigurationAssessment
| join kind=inner DeviceTvmSecureConfigurationAssessmentKB on ConfigurationId
| where IsCompliant == 0 and IsApplicable == 1
| summarize ConfigurationImpactScore =  sum(ConfigurationImpact), ImpactedConfiguration = make_set(ConfigurationName), ConfigID = make_set(ConfigurationId) by DeviceName
| sort by ConfigurationImpactScore

Platforms

microsoft-defender

Tags

vulnerability-management

Raw Content

# Device congifuration not compliant 
----
## Defender XDR
```KQL
DeviceTvmSecureConfigurationAssessment
| join kind=inner DeviceTvmSecureConfigurationAssessmentKB on ConfigurationId
| where IsCompliant == 0 and IsApplicable == 1
| summarize ConfigurationImpactScore =  sum(ConfigurationImpact), ImpactedConfiguration = make_set(ConfigurationName), ConfigID = make_set(ConfigurationId) by DeviceName
| sort by ConfigurationImpactScore
```