Current correlations between devices and customer-defined vulnerabilities, with one record per device and custom vulnerability rather than a stream of detection events. Join with DeviceCustomVulnerabilitiesKB on CustomVulnerabilityId to retrieve the vulnerability definition. Available under Vulnerability management in Advanced Hunting for eligible tenants when customer exposure is enabled and you have vulnerability management reader permissions. Device results follow your Microsoft Defender for Endpoint device-group permissions: restricted users see only their allowed groups, and users with no allowed groups receive no device rows.
Schema
Name
Description
Type
CustomVulnerabilityId
Identifier of the customer-defined vulnerability correlated with the device. Join with DeviceCustomVulnerabilitiesKB on CustomVulnerabilityId to retrieve its definition
String
DeviceId
Unique identifier of the device correlated with the customer-defined vulnerability
String
DeviceName
Name of the device correlated with the customer-defined vulnerability
String
FirstSeenTime
Date and time when the correlation between the device and the customer-defined vulnerability was first observed
DateTime
FullImagePath
File image paths associated with the custom vulnerability correlation on the device
Object
IsDeleted
Indicates whether the device-to-vulnerability correlation is marked as deleted, not whether the vulnerability definition is deleted
Boolean
LastCorrelatedTime
Date and time when the device was most recently correlated with the customer-defined vulnerability
DateTime
MachineGroup
String
OrgId
Identifier of the organization that owns the device-to-vulnerability correlation
String
SourceSystem
String
TenantId
String
TimeGenerated
DateTime
Timestamp
Date and time when the device-to-vulnerability correlation record was generated