Most Common Services

Description

This query provides the most common services discovered

Query · kql

//
DeviceTvmSoftwareVulnerabilities 
| where ingestion_time() > ago(7d)
| summarize arg_max(DeviceId, *) by SoftwareVendor, SoftwareName
| summarize DiscoveredOnDevicesCount = dcount(DeviceId) by SoftwareVendor, SoftwareName
Raw source Most Common Services · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4a5e9079-8fca-451a-99f5-a3384755a6e8
name: Most Common Services
description: |
  This query provides the most common services discovered
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceTvmSoftwareVulnerabilities
tactics:
- Initial Access
- Execution
relevantTechniques: []
query: |
  //
  DeviceTvmSoftwareVulnerabilities 
  | where ingestion_time() > ago(7d)
  | summarize arg_max(DeviceId, *) by SoftwareVendor, SoftwareName
  | summarize DiscoveredOnDevicesCount = dcount(DeviceId) by SoftwareVendor, SoftwareName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.