ListCISAExploitedVulnerabilites.md

Function: ListCISAExploitedVulnerabilites()

Query Information

Description

This function lists all Known Exploited Vulnerabilities as classified by CISA. The parameter StartYear determines from which year on you want to list the vulnerabilities.

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

Defender XDR

let ListCISAExploitedVulnerabilites = (StartYear:long) { 
    let KnowExploitesVulnsCISA = externaldata(cveID: string, vendorProject: string, product: string, vulnerabilityName: string, dateAdded: datetime, shortDescription: string, requiredAction: string, dueDate: datetime, notes: string)[@"https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv"] with (format="csv", ignoreFirstRecord=True);
    KnowExploitesVulnsCISA
    | extend DueDateExceededByDays = datetime_diff('day', now(), dueDate) 
    | extend ReleaseYear = tolong(extract(@'CVE-(.*?)-', 1, cveID))
    | where ReleaseYear >= StartYear
};
// Example only list from 2023 or newer
ListCISAExploitedVulnerabilites(2023);

Sentinel

let ListCISAExploitedVulnerabilites = (StartYear:long) { 
    let KnowExploitesVulnsCISA = externaldata(cveID: string, vendorProject: string, product: string, vulnerabilityName: string, dateAdded: datetime, shortDescription: string, requiredAction: string, dueDate: datetime, notes: string)[@"https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv"] with (format="csv", ignoreFirstRecord=True);
    KnowExploitesVulnsCISA
    | extend DueDateExceededByDays = datetime_diff('day', now(), dueDate) 
    | extend ReleaseYear = tolong(extract(@'CVE-(.*?)-', 1, cveID))
    | where ReleaseYear >= StartYear
};
// Example only list from 2023 or newer
ListCISAExploitedVulnerabilites(2023);