End of Support software used
Active EOS Software
Query
DeviceTvmSoftwareInventory
| where EndOfSupportStatus == "EOS Version" or EndOfSupportStatus ==
"EOS Software"
| summarize TotalDevices = count(), EOS_Devices = make_set(DeviceName)
by SoftwareName, SoftwareVersion
| sort by TotalDevicesAbout this query
End of Support software used
Query Information
Description
End of Support software used
Defender XDR
Sentinel
DeviceTvmSoftwareInventory
| where EndOfSupportStatus == "EOS Version" or EndOfSupportStatus ==
"EOS Software"
| summarize TotalDevices = count(), EOS_Devices = make_set(DeviceName)
by SoftwareName, SoftwareVersion
| sort by TotalDevices
Explanation
This query is designed to identify and summarize software that is no longer supported (End of Support, or EOS) on devices within a network. Here's a simple breakdown of what the query does:
-
Data Source: The query pulls data from the
DeviceTvmSoftwareInventorytable, which contains information about software installed on devices. -
Filter Criteria: It filters the data to include only software that has an "End of Support" status. This is indicated by either "EOS Version" or "EOS Software" in the
EndOfSupportStatusfield. -
Summarization: For each software name and version, the query calculates:
TotalDevices: The total number of devices using that particular software.EOS_Devices: A list of device names that have this unsupported software installed.
-
Sorting: The results are sorted by the total number of devices using each software, in ascending order.
The query is essentially the same for both Defender XDR and Sentinel, indicating that it is applicable in both contexts for identifying unsupported software across devices.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators