Query

DeviceTvmHardwareFirmware 
| where ComponentType == @"Processor"
| project ProcFamily = parse_json(AdditionalFields)["Family"]
| summarize count() by tostring(ProcFamily)
| sort by ProcFamily asc

About this query

Identify and summarize processor families in your environment

Description

The following query leverages DeviceTvmHardwareFirmware and will help you build an estate of your environment’s processors which will allow you to identify possibly old and non-reliable devices in your organization.

DeviceTvmHardwareFirmware

Microsoft Defender XDR

Versioning

Version	Date	Comments
1.0	05/12/2024	Initial publish

Explanation

This KQL (Kusto Query Language) query is designed to analyze the processors in your organization's environment using data from the DeviceTvmHardwareFirmware table. Here's a simple breakdown of what the query does:

Filter for Processors: It starts by filtering the data to only include entries where the ComponentType is "Processor."
Extract Processor Family: It then extracts the processor family information from the AdditionalFields column, which is stored in JSON format. This information is labeled as ProcFamily.
Count Processor Families: The query counts how many devices belong to each processor family.
Sort Results: Finally, it sorts the results in ascending order based on the processor family.

The output of this query will be a list of processor families present in your environment along with the count of devices for each family. This can help you identify potentially outdated or unreliable processors in your organization.

KQL Search