Create identify-non-compliant-controls-with-relevant-remediation-acti…

…ons.md
cyb3rmik3 · Dec 5, 2024 · 4c25420 · 4c25420
1 parent c33125c
commit 4c25420
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/MDVM/identify-non-compliant-controls-with-relevant-remediation-actions.md b/MDVM/identify-non-compliant-controls-with-relevant-remediation-actions.md
@@ -0,0 +1,23 @@
+# Identify non-compliant controls with relevant remediation actions
+
+# Description
+
+The following query leverages DeviceBaselineComplianceAssessment and DeviceBaselineComplianceAssessmentKB. You may choose a baseline assessment profile and then focus on controls that have been found not to be compliant with their relevant remediation options.
+
+### Microsoft Defender XDR
+```
+let Profile = ""; // Insert ProfileId here
+DeviceBaselineComplianceAssessment
+| where ProfileId == Profile 
+| where IsCompliant == "0"
+| where IsExempt == "0"
+| join kind=inner (
+    DeviceBaselineComplianceAssessmentKB
+) on ConfigurationId
+| summarize by ConfigurationId, ConfigurationName, ConfigurationDescription, ConfigurationCategory, RemediationOptions, ConfigurationBenchmark
+```
+
+### Versioning
+| Version       | Date          | Comments                               |
+| ------------- |---------------| ---------------------------------------|
+| 1.0           | 05/12/2024    | Initial publish                        |