MD AV Signature and Platform Version

id: 30035880-b7af-4d5e-8617-be7f070a5c1c
name: MD AV Signature and Platform Version
description: |
  This query will identify the Microsoft Defender Antivirus Engine version and Microsoft Defender Antivirus Security Intelligence version (and timestamp), Product update version (aka Platform Update version) as well as the Microsoft Defender Antivirus Mode on the endpoint (Active, Passive, etc.).
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceTvmSecureConfigurationAssessment
tactics:
- Vulnerability
- Misconfiguration
query: |
  let avmodetable = DeviceTvmSecureConfigurationAssessment
  | where ConfigurationId == "scid-2010" and isnotnull(Context)
  | extend avdata=parsejson(Context)
  | extend AVMode = iif(tostring(avdata[0][0]) == '0', 'Active' , iif(tostring(avdata[0][0]) == '1', 'Passive' ,iif(tostring(avdata[0][0]) == '4', 'EDR Blocked' ,'Unknown')))
  | project DeviceId, AVMode;
  DeviceTvmSecureConfigurationAssessment
  | where ConfigurationId == "scid-2011" and isnotnull(Context)
  | extend avdata=parsejson(Context)
  | extend AVSigVersion = tostring(avdata[0][0])
  | extend AVEngineVersion = tostring(avdata[0][1])
  | extend AVSigLastUpdateTime = tostring(avdata[0][2])
  | extend AVProductVersion = tostring(avdata[0][3]) 
  | project DeviceId, DeviceName, OSPlatform, AVSigVersion, AVEngineVersion, AVSigLastUpdateTime, AVProductVersion, IsCompliant, IsApplicable
  | join avmodetable on DeviceId
  | project-away DeviceId1