Query Details
End Of Life Software With File Paths Using TVM
Query
DeviceTvmSoftwareInventory
| where SoftwareName != ""
| where EndOfSupportStatus in("EOS Version","Upcoming EOS Version")
| join kind=leftouter DeviceTvmSoftwareEvidenceBeta on DeviceId,SoftwareName
| summarize EarliestEndOfSupport=min(EndOfSupportDate) by SoftwareName,DeviceName,tostring(DiskPaths)
Explanation
This KQL (Kusto Query Language) query is designed to analyze software inventory data on devices, focusing on software that is nearing or has reached its end of support. Here's a simple breakdown of what the query does:
-
Data Source: It starts with the
DeviceTvmSoftwareInventorytable, which contains information about software installed on devices. -
Filter Software: It filters out any entries where the software name is empty, ensuring only valid software entries are considered.
-
End of Support Status: It further filters the data to include only software that is either already at the end of support ("EOS Version") or will soon reach the end of support ("Upcoming EOS Version").
-
Join with Evidence Data: The query performs a left outer join with the
DeviceTvmSoftwareEvidenceBetatable. This means it combines data from both tables based on matchingDeviceIdandSoftwareName, but keeps all entries from the left table (DeviceTvmSoftwareInventory), even if there is no match in the right table. -
Summarize Results: Finally, it summarizes the data by calculating the earliest end of support date (
EarliestEndOfSupport) for each combination of software name, device name, and disk paths. This helps identify which software on which devices is closest to losing support.
In essence, this query helps identify and prioritize software that needs attention due to its support status, providing insights into which devices and software installations are most urgent to address.
Details
Jay Kerai
Released: March 10, 2025
Tables
Keywords
Operators