Devices-With-Recent-Exploitable-Vulnerability.md

Devices with a recent vulnerability that is exploitable

---

Defender XDR

let timeframe = 30d; //Customizable h = hours, d = days
let ExploitableVulnerabilities = DeviceTvmSoftwareVulnerabilitiesKB
     | where IsExploitAvailable == 1
     | where PublishedDate > (now() - timeframe)
     | project CveId;
DeviceTvmSoftwareVulnerabilities
| join kind=inner ExploitableVulnerabilities on CveId
| summarize TotalVulnerabilities = count(), ExploitableCVE = make_set(CveId) by DeviceName, DeviceId
| top 10 by TotalVulnerabilities