KQL Search

Query Details

HomeAI ToolsDevice Query

Internet Facing Devices Vulnerablility Report

Query

// https://www.greynoise.io/resources/how-resurgent-vulnerabilities-jeopardize-organizational-security

// Internet facing devices vulnerablility report

let InternetFacing =
DeviceInfo
| where IsInternetFacing == true and isnotempty(PublicIP)
| distinct DeviceId;
DeviceTvmSoftwareVulnerabilities
| where DeviceId has_any(InternetFacing)
| summarize VulnerabilityCount=count() by DeviceName, VulnerabilitySeverityLevel
| sort by VulnerabilityCount desc

Explanation

This KQL (Kusto Query Language) query is designed to generate a report on vulnerabilities found in internet-facing devices within an organization. Here's a simple breakdown of what the query does:

  1. Identify Internet-Facing Devices:

    • It first filters the DeviceInfo table to find devices that are internet-facing (i.e., devices with a public IP address).
    • It creates a list of unique DeviceIds for these internet-facing devices.

  2. Find Vulnerabilities:

    • It then looks into the DeviceTvmSoftwareVulnerabilities table to find any vulnerabilities associated with these internet-facing devices.
    • It counts the number of vulnerabilities for each device and groups them by the device name and the severity level of the vulnerabilities.

  3. Sort the Results:

    • Finally, it sorts the results in descending order based on the number of vulnerabilities, so that devices with the most vulnerabilities appear first.

In summary, this query helps identify which internet-facing devices have vulnerabilities, how many vulnerabilities each device has, and the severity of those vulnerabilities, prioritizing the devices with the highest number of vulnerabilities.

Details

Steven Lim profile picture

Steven Lim

Released: May 12, 2025

Tables

DeviceInfoDeviceTvmSoftwareVulnerabilities

Keywords

DeviceInfoDeviceTvmSoftwareVulnerabilitiesDeviceIdPublicIPDeviceNameVulnerabilitySeverityLevelVulnerabilityCount

Operators

let|where==andisnotemptydistincthas_anysummarizecount()bysortdesc

Actions