Vuln-HighestExposedDevices.kql

//Summarize your devices by which Microsoft CVEs they are vulnerable too. The data is summarized into severity and ordered by the most exposed devices.
//This query only works in Advanced Hunting as the DeviceTvm* tables aren't sent to Sentinel yet
DeviceTvmSoftwareVulnerabilities
| summarize ['Critical Severity Vulnerabilities']=make_set_if(CveId, SoftwareVendor == "microsoft" and VulnerabilitySeverityLevel == "Critical"),
    ['High Severity Vulnerabilities']=make_set_if(CveId, SoftwareVendor == "microsoft" and VulnerabilitySeverityLevel == "High"),
    ['Medium Severity Vulnerabilities']=make_set_if(CveId, SoftwareVendor == "microsoft" and VulnerabilitySeverityLevel == "Medium"), 
    ['Low Severity Vulnerabilities']=make_set_if(CveId, SoftwareVendor == "microsoft" and VulnerabilitySeverityLevel == "Low")
    by DeviceName
| sort by array_length(['Critical Severity Vulnerabilities']) desc