Top 10 devices with the most exploitable vulnerabilities

Description

This query lists the 10 devices in your tenant with the most exploitable vulnerabilities.

Query · kql

let ExploitableVulnerabilities = DeviceTvmSoftwareVulnerabilitiesKB
     | where IsExploitAvailable == 1
     | project CveId;
DeviceTvmSoftwareVulnerabilities
| where CveId in (ExploitableVulnerabilities)
| summarize TotalExploitableVulns = dcount(CveId), ExploitableCVE = make_set(CveId) by DeviceId
| top 10 by TotalExploitableVulns
Raw source Top 10 devices with the most exploitable vulnerabilities · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Top 10 devices with the most exploitable vulnerabilities

## Query Information

#### Description
This query lists the 10 devices in your tenant with the most exploitable vulnerabilities.

## Defender XDR
```KQL
let ExploitableVulnerabilities = DeviceTvmSoftwareVulnerabilitiesKB
     | where IsExploitAvailable == 1
     | project CveId;
DeviceTvmSoftwareVulnerabilities
| where CveId in (ExploitableVulnerabilities)
| summarize TotalExploitableVulns = dcount(CveId), ExploitableCVE = make_set(CveId) by DeviceId
| top 10 by TotalExploitableVulns
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.