KQL - Defender Security Control Compliance Gaps
Identifies devices with missing or non-compliant Microsoft Defender security controls across Windows, Linux, and macOS endpoints. The query reviews Microsoft Defender Vulnerability Management (TVM) secure configuration assessments and highlights devices where critical security capabilities are not functioning as expected, including: Microsoft Defender Sensor Sensor Data Collection Defender Communications Tamper Protection Real-time Protection PUA Protection Cloud-delivered Protection Security Definitions Results are enriched with device exposure levels, machine groups, and sensor health status to assist security teams with remediation prioritization.
Microsoft Sentinel (KQL)
