Search for a command to run...
With a focus on Microsoft Defender Vulnerability Management
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
In case you are using Microsoft Defender you are familiar with the security.microsoft.com portal. You also probably know that Microsoft also offers API for this security solution.
Today I will show you some of my PowerShell commands (M365DefenderStuff module) with a focus on the 'Microsoft Defender Vulnerability Management' part.
The main benefit of using my module instead of direct API calls is built-in support for pagination, throttling, time-outs, and other nasty things 😎.
In general license for using Microsoft Defender solution
Special license for using 'Microsoft Defender Vulnerability Management' in case you want to see found vulnerabilities on your clients
To be able to use my PowerShell commands, you must first install the M365DefenderStuff module from the PowerShell Gallery.
Install-Module M365DefenderStuff
Get-Command -module M365DefenderStuffGet-Help <functionname> -Full).Import-Module Az.Accounts
Connect-AzAccount
# get all machines
Get-M365DefenderMachine
# get just specific machine
Get-M365DefenderMachine -machineId 'fff5e5e26cb0848d66bbb0bc83de6bceb4a1b2e1'
Get-M365DefenderMachineUser -machineId 'fff5e5e26cb0848d66bbb0bc83de6bceb4a1b2e1'
# get all detected applications
Get-M365DefenderSoftware
# get just specific application
Get-M365DefenderSoftware -softwareId 'adobe-_-creative_cloud'
# get all found vulnerabilities (can take several minutes to complete!)
Get-M365DefenderVulnerability
# get details of specific vulnerability
Get-M365DefenderVulnerability -vulnerabilityId 'CVE-2022-47926'
# get just software vulnerabilities of CTRITICAL type and group them by machine
Get-M365DefenderVulnerabilityReport -groupBy machine -skipOSVuln -severity Critical
Invoke-M365DefenderAdvancedQuery -query "DeviceInfo | join kind = fullouter DeviceTvmSoftwareEvidenceBeta on DeviceId"
# get all (100 000 at most) applications evidences
Invoke-M365DefenderSoftwareEvidenceQuery
# get all (100 000 at most) applications evidences related to JRE software
Invoke-M365DefenderSoftwareEvidenceQuery -appName JRE
# get all security recommendations
Get-M365DefenderRecommendation
# get security recommendations just for Putty software.
Get-M365DefenderRecommendation -productName 'putty'
# get all security recommendations for given machine.
Get-M365DefenderRecommendation -machineId '43a802402664e76a021c8dda2e2aa7db6a09a5f1'
# retrieves a list of all the vulnerabilities affecting the organization per machine and software.
Get-M365DefenderMachineVulnerability
That is all for now, but more functions will be added in the future to the M365DefenderStuff module don't worry 😉