Microsoft Defender AV Platform up to date information

id: 4EBA78B0-8E8E-4E9A-9AFF-160372BDD201
name: Microsoft Defender AV Platform up to date information
description: |
  'Provides the Platform version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the Platform version.'
requiredDataConnectors: []
tactics: []
relevantTechniques: []
query: |
    let expiringPublishdate = ago(8d);
    DeviceTvmInfoGathering
    | extend DataRefreshTimestamp = Timestamp,    
    AvIsPlatformUpToDateTemp=tostring(AdditionalFields.AvIsPlatformUptodate),
    AvSignatureDataRefreshTime = todatetime(AdditionalFields.AvSignatureDataRefreshTime), 
    AvSignaturePublishTime = todatetime(AdditionalFields.AvSignaturePublishTime),
    AvPlatformVersion =  tostring(AdditionalFields.AvPlatformVersion) 
    | extend AvIsPlatformUpToDate = iif(((((isempty(AvIsPlatformUpToDateTemp)
    or (isnull(AvSignatureDataRefreshTime)))
    or (isnull(AvSignaturePublishTime)))
    or (AvSignatureDataRefreshTime < expiringPublishdate))
    or (AvSignaturePublishTime < expiringPublishdate)), "Unknown", tostring(AvIsPlatformUpToDateTemp)) 
    | extend AvPlatformVersion = iif(AvPlatformVersion == "", "Unknown", AvPlatformVersion)
    | project DeviceId, DeviceName,  OSPlatform, AvPlatformVersion, DataRefreshTimestamp, AvIsPlatformUpToDate, AvSignaturePublishTime, AvSignatureDataRefreshTime
    | summarize DeviceCount = count(), DataRefreshTimestamp = max(DataRefreshTimestamp), PlatformUpToDateDeviceCount = countif(AvIsPlatformUpToDate == "true"),  PlatformNotUpToDateDeviceCount = countif(AvIsPlatformUpToDate == "false"),  PlatformNotAvailableDeviceCount = countif(AvIsPlatformUpToDate == "Unknown") by OSPlatform,AvPlatformVersion