Forum Discussion

danny_grasso's avatar
danny_grasso
Brass Contributor
Dec 19, 2023

Find OpenSSL affected files using advanced hunting

While it's possible to view an individual devices software inventory in Defender XDR - this becomes an inefficient way of identifying and addressing vulnerable applications that use OpenSSL components. I am trying to use advanced hunting to find when an OpenSSL vulnerability exists and when a weakness is present on devices and supply the affected files.

 

So far my query looks like this but I cannot figure out how to get the Weaknesses where count is >=1.

 

DeviceTvmSoftwareVulnerabilities
| join kind=innerunique (DeviceTvmSoftwareEvidenceBeta) on DeviceId
| where SoftwareVendor contains "openssl"

 

 

No RepliesBe the first to reply

Resources