Software vulnerabilities found on devices and the list of available security updates that address each vulnerability
Defender
Table retention
ColdDays
HotDays
TotalInteractiveDays
0
30
30
Schema
Name
Description
Type
AadDeviceId
Unique identifier for the device in Microsoft Entra ID
String
CveId
Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system
String
CveMitigationStatus
Indicates the status of the workaround mitigation for the CVE on this device (possible values: applied, not applied, partially applied, pending reboot)
String
CveTags
Array of tags relevant to the CVE; example: ZeroDay, NoSecurityUpdate
Object
DeviceId
Unique identifier for the device in Microsoft Defender for Endpoint
String
DeviceName
Fully qualified domain name (FQDN) of the device
String
MachineGroup
String
OSArchitecture
Architecture of the operating system running on the machine
String
OSPlatform
Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7
String
OSVersion
Version of the operating system running on the machine
String
ProductCategory
Category of the software product
String
RecommendedSecurityUpdate
Name or description of the security update provided by the software vendor to address the vulnerability
String
RecommendedSecurityUpdateId
Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles
String
SoftwareName
Name of the software product
String
SoftwareVendor
Name of the software vendor
String
SoftwareVersion
Version number of the software product
String
SourceSystem
String
TenantId
String
Type
String
VulnerabilitySeverityLevel
Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape