Bert-Jan Pals unknown stable kql

Prioritize Secure Configuration

This query helps you prioritize configuration changes that affect your devices based on the Microsoft Defender TVM modules.

View Source

Detection Logic

DeviceTvmSecureConfigurationAssessment
| summarize TotalDevices = dcount(DeviceId) by ConfigurationId, ConfigurationCategory
| join kind=inner DeviceTvmSecureConfigurationAssessmentKB on ConfigurationId
| sort by ConfigurationImpact, TotalDevices
| project-reorder ConfigurationId, ConfigurationImpact, TotalDevices, ConfigurationName,  ConfigurationCategory, ConfigurationSubcategory

Field Validations

Loading…

Comments (0)

Loading comments...