KQL Library

Reference only · no query execution

Queries stored by SecOps Signal for Microsoft Defender and Sentinel hunting. Each shows its static-screening result and generation source; none has been run against a tenant.

Published queries2,127stored Deterministic templates2,087generated Adapted from Sentinel0with reference

CVEs covered2,087distinct

Runtime validated0of 2,127

CVE-2026-94127Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-94127
Identify Defender-managed devices currently reporting exposure to CVE-2026-94127.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-94127"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-93952Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-93952
Identify Defender-managed devices currently reporting exposure to CVE-2026-93952.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-93952"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-93616Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-93616
Identify Defender-managed devices currently reporting exposure to CVE-2026-93616.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-93616"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-85102Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-85102
Identify Defender-managed devices currently reporting exposure to CVE-2026-85102.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-85102"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-71362Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-71362
Identify Defender-managed devices currently reporting exposure to CVE-2026-71362.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-71362"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-5430Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-5430
Identify Defender-managed devices currently reporting exposure to CVE-2026-5430.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-5430"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-87902Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-87902
Identify Defender-managed devices currently reporting exposure to CVE-2026-87902.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-87902"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-67279Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-67279
Identify Defender-managed devices currently reporting exposure to CVE-2026-67279.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-67279"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-88772Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-88772
Identify Defender-managed devices currently reporting exposure to CVE-2026-88772.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-88772"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-88771Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-88771
Identify Defender-managed devices currently reporting exposure to CVE-2026-88771.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-88771"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-86950Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-86950
Identify Defender-managed devices currently reporting exposure to CVE-2026-86950.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-86950"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-76504Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-76504
Identify Defender-managed devices currently reporting exposure to CVE-2026-76504.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-76504"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-104286Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-104286
Identify Defender-managed devices currently reporting exposure to CVE-2026-104286.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-104286"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-102490Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-102490
Identify Defender-managed devices currently reporting exposure to CVE-2026-102490.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-102490"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-88779Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-88779
Identify Defender-managed devices currently reporting exposure to CVE-2026-88779.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-88779"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2023-22894Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2023-22894
Identify Defender-managed devices currently reporting exposure to CVE-2023-22894.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2023-22894"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2021-3199Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2021-3199
Identify Defender-managed devices currently reporting exposure to CVE-2021-3199.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2021-3199"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2016-3081Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2016-3081
Identify Defender-managed devices currently reporting exposure to CVE-2016-3081.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2016-3081"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2015-5477Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2015-5477
Identify Defender-managed devices currently reporting exposure to CVE-2015-5477.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2015-5477"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2015-3306Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2015-3306
Identify Defender-managed devices currently reporting exposure to CVE-2015-3306.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2015-3306"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2026-68820Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2026-68820
Identify Defender-managed devices currently reporting exposure to CVE-2026-68820.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-68820"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2025-55753Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2025-55753
Identify Defender-managed devices currently reporting exposure to CVE-2025-55753.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2025-55753"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2025-66506Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2025-66506
Identify Defender-managed devices currently reporting exposure to CVE-2025-66506.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2025-66506"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2025-66576Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2025-66576
Identify Defender-managed devices currently reporting exposure to CVE-2025-66576.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2025-66576"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query
CVE-2025-65958Exposure CheckExposure assessment
Detect endpoints exposed to CVE-2025-65958
Identify Defender-managed devices currently reporting exposure to CVE-2025-65958.
```
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2025-65958"
| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId
…
```
Schema CheckedNot runtime validated
Table: DeviceTvmSoftwareVulnerabilities · SecOps Signal deterministic template · Limited verificationView query

Showing 1 – 25 of 2,127 matching queries (2,127 stored)

Rows:10 25 50

Reading these queries

Schema Checked means the query passed SecOps Signal's structural screening against a reviewed table list. It is not a tenant test.
Not runtime validated means no one has recorded running it against live telemetry. Treat every query as a starting point and customise it.
Starter query appears where the stored record is marked as a starter or its reference lookup was deferred. Adapted queries credit the public Microsoft Sentinel reference they came from.