How to get a list of vulnerabilities on virtual machines using Resource Graph Explorer?

Question

How to get a list of vulnerabilities on virtual machines using Resource Graph Explorer?

Martin D 61

Hi!

I've been using this query to get information about vulnerabilities using Resource Graph Explorer but it doesn't seem to work anymore.

securityresources
| where type == "microsoft.security/assessments"
| where * contains "vulnerability findings"
| summarize by assessmentKey=name 
 | join kind=inner (
    securityresources
     | where type == "microsoft.security/assessments/subassessments"
     | extend assessmentKey = extract(".*assessments/(.+?)/.*",1,  id)
 ) on assessmentKey
| project assessmentKey, subassessmentKey=name, id, parse_json(properties), resourceGroup, subscriptionId, tenantId
| extend description = properties.description,
         displayName = properties.displayName,
         resourceId = properties.resourceDetails.id,
         resourceSource = properties.resourceDetails.source,
         category = properties.category,
         severity = properties.status.severity,
         code = properties.status.code,
         timeGenerated = properties.timeGenerated,
         remediation = properties.remediation,
         impact = properties.impact,
         vulnId = properties.id,
         additionalData = properties.additionalData

I've also tried this query using the old (?) assement key in the query with "| where name == "1195afff-c881-495e-9bc5-1486211ae03f", but to no avail.

Has the data structure changed in the security resources table, and if so is there a different query that what would get me the same data of the vulnerabilities present on my virtual machines?

0 comments

3 answers

Your answer

Answer 1

I think this is the July 31, 2026 retirement of grouped recommendations, not a missing assessment key. 1195afff-c881-495e-9bc5-1486211ae03f is deprecated. The old sub-assessment join won't retrieve its retired findings.

Try this in Resource Graph Explorer:

securityresources

| where type == "microsoft.security/assessments"

| where properties.resourceDetails.ResourceType =~ "microsoft.compute/virtualmachines"

| where properties.metadata.recommendationCategory == "SoftwareUpdate"

| extend CVEs = parse_json(tostring(properties.additionalData.CvesDetails))

| mv-expand CVE = CVEs

| project id, subscriptionId,

Finding = tostring(properties.displayName),

Severity = tostring(properties.metadata.severity),

CveId = tostring(CVE.CveId)

The schema changed too. Severity is now under metadata, and CVEs under additionalData.CvesDetails. For extended CVE data, use microsoft.security/cvedetails at tenant scope.

Answer 2

SHOUMIK CHAKRAVARTY 1,150

@kagiyama yutaka has the cause right, here’s the documentation behind it. From Transition from grouped to individual recommendations: “Grouped recommendations were deprecated on July 31, 2026.” Your key is listed on that page as a deprecated assessment ID in the SoftwareUpdate category.

So it isn’t a matter of finding a replacement key. The documented route now is to filter by recommendation category SoftwareUpdate instead.

0 comments

Answer 3

Yes. The query pattern for VM vulnerability findings uses the current assessment/subassessment structure in SecurityResources, and the documented sample is:

SecurityResources
| where type == 'microsoft.security/assessments'
| where * contains 'vulnerabilities in your virtual machines'
| summarize by assessmentKey=name
| join kind=inner (
    securityresources
    | where type == 'microsoft.security/assessments/subassessments'
    | extend assessmentKey = extract('.*assessments/(.+?)/.*', 1, id)
) on assessmentKey
| project assessmentKey, subassessmentKey=name, id, parse_json(properties), resourceGroup, subscriptionId, tenantId
| extend description = properties.description,
    displayName = properties.displayName,
    resourceId = properties.resourceDetails.id,
    resourceSource = properties.resourceDetails.source,
    category = properties.category,
    severity = properties.status.severity,
    code = properties.status.code,
    timeGenerated = properties.timeGenerated,
    remediation = properties.remediation,
    impact = properties.impact,
    vulnId = properties.id,
    additionalData = properties.additionalData

Key change to make in the existing query:

Replace | where * contains "vulnerability findings" with | where * contains 'vulnerabilities in your virtual machines'

That is the documented filter for listing Qualys vulnerability assessment results on virtual machines.

If CVE details are also needed, query the tenant-level global table:

securityresources
| where type =~ "microsoft.security/cvedetails"

Important scope behavior:

The CVE details table is a tenant-level global table.
To retrieve CVE details, run the query at tenant scope.
If results are needed for specific subscriptions, filter subscription IDs inside the query instead of limiting the query scope to subscriptions.

Also note the Azure Resource Graph query limits:

There is a default limit of three join operators and three mv-expand operators in a single Resource Graph SDK query.
A table can't be referenced as the right table multiple times, or a DisallowedMaxNumberOfRemoteTables error can occur.