SecOps SignalSecurity Intelligence Workspace
Collection Degraded30 / 46 Sources HealthyPublic Intel Only
KQL Library/Source hunting queryReference only
Record c1f46c8228d3c4ae68a78b05 · v1
Schema CheckedNot runtime validated

known-affected-software-orion[Nobelium]

Source repository hunting query

Generation sourcesource-file · Limited verification
Attributionmicrosoft
Last updated01 Apr 2021, 03:28 PM IST
Last checked17 Oct 2026
View original guidance
Kusto query · 3 linesTable: DeviceTvmSoftwareVulnerabilities · Microsoft Defender XDR / Sentinel
DeviceTvmSoftwareVulnerabilities| where CveId == 'TVM-2020-0002'| project DeviceId, DeviceName, SoftwareVendor, SoftwareName, SoftwareVersion

SecOps Signal does not execute queries against private telemetry. Paste the query into Microsoft Sentinel Log Analytics or Defender advanced hunting and review it first. Passed structure and schema checks; tenant execution is not verified.

Query anatomy

Static check against a reviewed column list
Columns projected by the query
ColumnTableIn reviewed schema list
DeviceIdDeviceTvmSoftwareVulnerabilitiesListed
DeviceNameDeviceTvmSoftwareVulnerabilitiesListed
SoftwareVendorDeviceTvmSoftwareVulnerabilitiesListed
SoftwareNameDeviceTvmSoftwareVulnerabilitiesListed
SoftwareVersionDeviceTvmSoftwareVulnerabilitiesListed

“Listed” only means the column name appears in the reviewed list for that table. It does not confirm the column exists in your tenant's current schema, and per-column purposes are not recorded.

Hunting notes

MITRE ATT&CKNot mapped
Analytical purpose

Source repository hunting query

When to use

Review the source query and adapt it to your tenant before use.

Limitations

Schema checked only. This query has not been executed against a Sentinel or Defender tenant.

known-affected-software-orion[Nobelium] | SecOps Signal