Queries for the QualysKnowledgeBase table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Qualys vulnerability summary by severity

Returns a summary of Qualys vulnerabilities grouped by severity level, category, and vulnerability type, including counts of patchable and unpatchable vulnerabilities.

QualysKnowledgeBase
| extend SoftwareVendorList = tostring(SoftwareVendor)
| summarize
 VulnerabilityCount = count(),
 PatchableCount = countif(Patchable == "1"),
 UnpatchableCount = countif(Patchable == "0"),
 CveCount = dcount(tostring(CveId)),
 Cves = make_list(CveId),
 Qids = make_list(Qid),
 AffectedVendors = make_set(SoftwareVendorList)
 by SeverityLevel, Category, VulnType
| extend VendorList = strcat_array(AffectedVendors, ", ")
| project
 SeverityLevel,
 Category,
 VendorList,
 VulnType,
 VulnerabilityCount,
 PatchableCount,
 UnpatchableCount,
 CveCount,
 Qids,
 Cves
| order by SeverityLevel desc, VulnerabilityCount desc
| order by SeverityLevel desc, VulnerabilityCount desc

Qualys vulnerabilities with Threat Intelligence

Returns Qualys vulnerabilities that have active threat intelligence indicators, including threat levels and exploit information.

QualysKnowledgeBase
| where isnotnull(ThreatIntelligence) and array_length(ThreatIntelligence) > 0
| mv-expand ThreatIntel = ThreatIntelligence
| where isnotnull(ThreatIntel)
| extend
 ThreatLevel = tostring(ThreatIntel["#cdata-section"]),
 ThreatId = tostring(ThreatIntel.id)
| where isnotempty(ThreatLevel) and isnotempty(ThreatId)
| extend
 IsPciRelevant = PciFlag == "1",
 IsPatchable = Patchable == "1",
 CveCount = array_length(CveId)
| summarize
 ThreatLevels = make_set(ThreatLevel),
 ThreatIds = make_set(ThreatId),
 HighestThreatId = max(toint(ThreatId))
 by TimeGenerated, Qid, VulnTitle, SeverityLevel, Category, VulnType,
 IsPatchable, IsPciRelevant, tostring(CveId), CveCount, tostring(SoftwareVendor),
 tostring(SoftwareProduct), PublishedDatetime, LastServiceModificationDateTime,
 Solution, Consequence
| project
 TimeGenerated,
 Qid,
 VulnTitle,
 SeverityLevel,
 HighestThreatId,
 ThreatLevels,
 ThreatIds,
 Category,
 VulnType,
 IsPatchable,
 IsPciRelevant,
 CveId = parse_json(CveId),
 CveCount,
 SoftwareVendor = parse_json(SoftwareVendor),
 SoftwareProduct = parse_json(SoftwareProduct),
 PublishedDatetime,
 LastServiceModificationDateTime,
 Solution,
 Consequence
| order by SeverityLevel desc, HighestThreatId desc, PublishedDatetime desc