No access to DeviceTvmSoftwareVulnerabilities table in Sentinel?

Question

There is an XDR analytic rule in Sentinel named "Execution of software vulnerable to webp buffer overflow of CVE-2023-4863"

However the kql query used by this rule requires access to the DeviceTvmSoftwareVulnerabilities table.

But according to what I'm reading, that table is not accessible from Sentinel and the XDR data connector doesn't provide an option to make it available.

So am I correct in assuming this rule will never work in Sentinel?

(I'm not trying to criticize Sentinel, I was just looking for a way to correlate using the XDR vulnerability data).

Thanks.

Answer 1

Hi @David Broggy
Thank you for reaching Microsoft Q&A Forum!

Your understating is correct, The DeviceTvmSoftwareVulnerabilities table is applies to Microsoft Defender XDR, which is not currently accessible from Sentinel.
The list off available Log Analytics table for sentinel is here
Appreciate if you could share the feedback on our feedback forum which is closely monitored by our product team.

Answer 2

You can ingest data into sentinel using this function

https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/M365Defender-VulnerabilityManagement