Azure KQL query to display list of VMs which were not patch for since 1 months



  • Is there a KQL query to get a list of VMs which are not patched since last month. Below is the sample I have

    Update
    | where Classification in ("Security Updates", "Critical Updates")
    | where UpdateState == 'Needed' and Optional == false and Approved == true
    | summarize count() by Classification, Computer, _ResourceId
    // This query requires the Security or Update solutions
    

    How to apply the filter to just show the ones which are due since one month



  • I was able to achieve that

    Update
    //|where OSType != "Linux" and UpdateState == "Needed" and Optional == "false"
    | where Classification in ("Security Updates", "Critical Updates") 
    | where PublishedDate 

Log in to reply
 


Suggested Topics