Blog Post

Microsoft Defender for Cloud Blog
2 MIN READ

How Defender for Cloud displays machines affected by Log4j vulnerabilities

melvynadam's avatar
melvynadam
Brass Contributor
Dec 13, 2021
When news breaks of a major security story, like the vulnerability in the open-source Apache logging library Log4j (CVE-2021-44228), vendors and organizations move as fast as they can to understand t...
Updated Feb 01, 2022
Version 8.0
cloud security
cloud security posture management
vulnerabilities
melvynadam's avatar
Brass Contributor
Joined October 28, 2019
View Profile
Microsoft Defender for Cloud Blog
Microsoft Defender for Cloud is a cloud-native application platform (CNAPP) that offers security and compliance from code to runtime, enhanced by AI, for hybrid and multicloud environments.
Tushar_Mudi's avatar
Tushar_Mudi
Copper Contributor
Dec 21, 2021

Thank you for the KQL query.
Is it possible to use "has_any" instead of "has" and do this ?

I am getting an InvalidQuery error after I run this.

 

 

securityresources 
| where type =~ "microsoft.security/assessments/subassessments"
| extend assessmentKey=extract(@"(?i)providers/Microsoft.Security/assessments/([^/]*)", 1, id), subAssessmentId=tostring(properties.id), parentResourceId= extract("(.+)/providers/Microsoft.Security", 1, id)
| extend Props = parse_json(properties)
| extend additionalData = Props.additionalData
| extend cves = additionalData.cve
| where isnotempty(cves) and array_length(cves) > 0
| mv-expand cves
| where tostring(cves) has_any ("CVE-2021-44228","CVE-2021-45046","CVE-2021-45105")