Forum Discussion
Defender vulnerability report
I've been working with Defender threat hunting to get stats on vulnerabilities in my environment. Once thing I wanted to do was to track total vulnerabilities over time for specific software rather ...
How about using DeviceTvmSoftwareVulnerabilities with joins:
- Join with DeviceTvmSoftwareInventory
This table includes software data with timestamp fields like LastSeenDateTime, which gives a hint on software presence changes over time. While not tied directly to vulnerabilities, it can provide contextual clues. - Use DeviceEvents or DeviceNetworkEvents
These broader tables include time-stamped telemetry. If certain vulnerabilities correlate with specific event patterns (e.g., exploits), you may be able to infer time-based insights indirectly.