Forum Discussion

marktait19's avatar
marktait19
Copper Contributor
Feb 08, 2023
Solved

Security Recommendation - is it available in any table in KQL query editor

Hi.   When in Security Recommendations, I can enter a CVE reference, and there is a column in the display for "Security Recommendation" (please see attached screenshot).   So for example, for: CV...
microsoft defender for endpoint
microsoft defender for office 365
threat hunting
  • BaruchAbitbol's avatar
    BaruchAbitbol
    Mar 01, 2023
    fixed it.

    try this:

    DeviceTvmSecureConfigurationAssessment
    | project DeviceName, ConfigurationId
    | join kind=inner ( DeviceTvmSecureConfigurationAssessmentKB
    | project ConfigurationName, ConfigurationDescription, RiskDescription, ConfigurationCategory, ConfigurationImpact, ConfigurationSubcategory, RemediationOptions, ConfigurationId
    )
    on ConfigurationId
    | project ConfigurationId, DeviceName, ConfigurationName, ConfigurationDescription, RiskDescription, ConfigurationCategory, ConfigurationImpact, ConfigurationSubcategory, RemediationOptions
    | distinct DeviceName, ConfigurationId, ConfigurationName, ConfigurationDescription, RiskDescription, ConfigurationCategory, ConfigurationImpact, ConfigurationSubcategory, RemediationOptions
    | sort by DeviceName asc
keith-mad's avatar
keith-mad
Copper Contributor
Feb 22, 2023
I don't think you can. I'm currently waiting on the Recommendations section to be enabled via API calls so I could use a LogicApp to post daily updates on the Recommendations.
  • Jaideep445's avatar
    Jaideep445
    Copper Contributor
    Oct 31, 2023
    I have been able to connect to API via Power BI OData connection.
    Following query can be used as is in OData query.

    let
    Source = OData.Feed("https://api.securitycenter.microsoft.com/api/recommendations", null, [Implementation="2.0"]),
    #"Renamed Columns" = Table.RenameColumns(Source,{{"Vulnerabilities", "Vulnerabilities.1"}, {"Software", "Software.1"}, {"recommendationName", "Recommendation Name"}, {"productName", "Product Name"}, {"vendor", "Vendor"}, {"recommendedVersion", "Recommended Version"}, {"recommendationCategory", "Category"}, {"subCategory", "Sub Category"}, {"severityScore", "Severity Score"}, {"publicExploit", "Public Exploit"}, {"remediationType", "Remediation Type"}, {"exposedMachinesCount", "Exposed Machines"}})
    in
    #"Renamed Columns"

Resources