Exporting Vulnerability Assessment Results in Microsoft Defender for Cloud

How do we find the URL to qualys portal where we can also view all the assets scanned?

I am not able to find that in the documentation where it explains how to install qualys agent via azure portal.

Thanks YuriDiogenes for sharing this information. Updated script with a minor change 

securityresources
 | where type == "microsoft.security/assessments"
 | where * contains "Machines should have vulnerability findings resolved"
 | summarize by assessmentKey=name //the ID of the assessment
 | join kind=inner (
    securityresources
     | where type == "microsoft.security/assessments/subassessments"
     | extend assessmentKey = extract(".*assessments/(.+?)/.*",1,  id)
 ) on assessmentKey
| project assessmentKey, subassessmentKey=name, id, parse_json(properties), resourceGroup, subscriptionId, tenantId
| extend description = properties.description,
         displayName = properties.displayName,
         resourceId = properties.resourceDetails.id,
         resourceSource = properties.resourceDetails.source,
         category = properties.category,
         severity = properties.status.severity,
         code = properties.status.code,
         timeGenerated = properties.timeGenerated,
         remediation = properties.remediation,
         impact = properties.impact,
         vulnId = properties.id,
         additionalData = properties.additionalData

rkelly141   I have implemented the solution to pull the results of this query via function app into a SQL server and then pulled the same into Power BI. In that way I can assign vulnerabilities to image onwers by further adding the correlation in my SQL Server by creatin views. 

Based on our observation, the integrated Qualys Scanner is also detecting vulnerabilities of nonRunning Kernels on Linux. With the standalone license of Qualys such vulnerabilities can be easily filtered:

Exclude or display vulnerabilities for non-running Linux kernels (qualys.com)

Does anyone know if this detail (a specific vulnerability was found on the running or nonRunning kernel) is also exposed via resource graph? Or any other API of Defender for Cloud?

Good evening all

i have been thinking about this a lot as the scan and results are only current and no history.

i was thinking 2 solutions the first is a runbook running PowerShell to query the azure resource explorer and save this to a CSV once a week to a storage account (more or less frequent depending on your compliance levels)

the other way is very similar but the output is streamed to log analytics this way you can create alerts, dashboards and some history  

Good day,

Thanks for the great post. Got a quick question/request

how can we find where the vulnerability was detected? there are times where although a fix has been applied, Qualys still report the asset as vulnerable. In these scenarios you have to see where the vulnerability was detected "registry, user profile, file path to a vulnerable installer,...." this information is missing both in the portal and in the KQL query here.

Thanks a lot

Good evening all

Just playing with this at the moment in preparation for my AZ-500 exam, but thinking of real world scenario for work, after remediating initial findings is there a way to create an alert for when a new vulnerability is found?

or

A weekly report that is emailed?

Does anyone know if (produced but not supported by Microsoft) free AzTS toolset https://github.com/azsk/AzTS-docs supports Vulnerability data extraction? It is not clear from the PowerBI reports document - https://github.com/azsk/AzTS-docs/tree/main/02-Monitoring%20security%20using%20AzTS

I tried  to use logic app but the JSON parser could not work as data has multiple array and size limit. Then I used azure function to pull the KQL and add into SQL server. 

I am running automation via using the logic app and calling  my Function APP but the same  is failing with exception Have you tried automating this via any means?Yuri Diogenes

hnakada  just use a Logic App to schedule by time trigger and connect it for example with O365 to send email (or if you have any SMTP)