SOLVED

Missing KBs with Advanced Hunting

%3CLINGO-SUB%20id%3D%22lingo-sub-3253216%22%20slang%3D%22en-US%22%3EMissing%20KBs%20with%20Advanced%20Hunting%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3253216%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Team.%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20looking%20to%20use%20Advance%20Hunting%20to%20get%20list%20of%20Missing%20KBs%20on%20a%20Devices.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3263323%22%20slang%3D%22en-US%22%3ERe%3A%20Missing%20KBs%20with%20Advanced%20Hunting%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3263323%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1264199%22%20target%3D%22_blank%22%3E%40Sajidali125%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20is%20the%20simplest%20one%20you%20may%20use%20for%20one%20device%20if%20this%20is%20the%20output%20you%20are%20looking%20for%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDeviceTvmSoftwareVulnerabilities%20%3CBR%20%2F%3E%7C%20where%20RecommendedSecurityUpdate%20contains%20%22security%20updates%22%20and%20DeviceName%20%3D%3D%20%22ExactDeviceName%22%3CBR%20%2F%3E%7C%20distinct%20RecommendedSecurityUpdateId%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22LuizaT_0-1647944649615.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F357496i122EC94438F29D7E%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22LuizaT_0-1647944649615.png%22%20alt%3D%22LuizaT_0-1647944649615.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

Hi Team. 

I am looking to use Advance Hunting to get list of Missing KBs on a Devices.

 

 

1 Reply
best response confirmed by Sajidali125 (Senior Member)
Solution

Hi @Sajidali125,

 

This is the simplest one you may use for one device if this is the output you are looking for:

 

DeviceTvmSoftwareVulnerabilities
| where RecommendedSecurityUpdate contains "security updates" and DeviceName == "ExactDeviceName"
| distinct RecommendedSecurityUpdateId

 

LuizaT_0-1647944649615.png