Forum Discussion

dmarquesgn's avatar
dmarquesgn
Iron Contributor
Dec 06, 2023

Hunting query which works on the Portal but not on Powershell

Hi, I have a need to extract all my vulnerabilities from Defender TVM and export do JSON or CSV. I've built an hunting query which gives at least the results consistently. I've got more than 200k vu...
Windows PowerShell
Harm_Veenstra's avatar
Harm_Veenstra
MVP
Dec 11, 2023

dmarquesgn If I read https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/kql-quick-reference correctly,

 

joinMerges the rows of two tables to form a new table by matching values of the specified column(s) from each table. Supports a full range of join types: flouter, inner, innerunique, leftanti, leftantisemi, leftouter, leftsemi, rightanti, rightantisemi, rightouter, rightsemiLeftTable | join [JoinParameters] ( RightTable ) on Attributes

 

Shouldn't it be like this? 

 

$vulnUrl = '{ "query": "DeviceTvmSoftwareVulnerabilities | join [leftouter] (DeviceTvmSoftwareVulnerabilitiesKB) on CveId" }'

 

 

(Not an expert in this 😉 )

 

  • dmarquesgn's avatar
    dmarquesgn
    Iron Contributor
    Dec 18, 2023

    Harm_Veenstra 

    Thanks for your reply. I've tried that as well, but still get a (400) Bad Request.

    So something is still not being parsed correctly for Defender.

Resources