DeviceTvmSoftwareVulnerabilities

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Software vulnerabilities found on devices and the list of available security updates that address each vulnerability

Attribute Value
Category MDE
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Lake-Only Ingestion ✓ Yes
Azure Monitor Tables Reference View Documentation
Defender XDR Advanced Hunting Schema View Documentation

Contents

Schema (19 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
CveId string Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system
CveTags dynamic Array of tags relevant to the CVE; example: ZeroDay, NoSecurityUpdate
DeviceId string Unique identifier for the device in the service
DeviceName string Fully qualified domain name (FQDN) of the device
OSArchitecture string Architecture of the operating system running on the machine
OSPlatform string Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7
OSVersion string Version of the operating system running on the machine
RecommendedSecurityUpdate string Name or description of the security update provided by the software vendor to address the vulnerability
RecommendedSecurityUpdateId string Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles
SoftwareName string Name of the software product
SoftwareVendor string Name of the software vendor
SoftwareVersion string Version number of the software product
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Date and time when the record was generated
Type string The name of the table
VulnerabilitySeverityLevel string Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Content Items Using This Table (6)

Analytic Rules (1)

In solution Microsoft Defender XDR:

Analytic Rule Selection Criteria
Execution of software vulnerable to webp buffer overflow of CVE-2023-4863

Hunting Queries (5)

GitHub Only:

Hunting Query Selection Criteria
Most Common Services
devices_with_vuln_and_users_received_payload
devices_with_vuln_and_users_received_payload (1)
known-affected-software-orion[Nobelium] CveId == "TVM-2020-0002"
possible-affected-software-orion[Nobelium] SoftwareName startswith "orion"
SoftwareVendor == "solarwinds"

Selection Criteria Summary (2 criteria, 2 total references)

References by type: 0 connectors, 2 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
CveId == "TVM-2020-0002" - 1 - - 1
SoftwareName startswith "orion"
SoftwareVendor == "solarwinds"		 - 1 - - 1
Total 0 2 0 0 2

CveId

Value Connectors Content Items ASIM Parsers Other Parsers Total
TVM-2020-0002 - 1 - - 1

SoftwareName

Value Connectors Content Items ASIM Parsers Other Parsers Total
startswith orion - 1 - - 1

SoftwareVendor

Value Connectors Content Items ASIM Parsers Other Parsers Total
solarwinds - 1 - - 1

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index