Update python and Update openssl defender alert

Question

I received a defender alerts with high severity that suggested that I update the python and openssl versions on my VM. But currently I do not have any python installations on my VM. Turns out that none of my applications or software use python. I do not see any details as to where the file is installed or what version is expected to fix the issues. Please guide me through the remediation process.

Answer 1

Locate Defender’s file or registry evidence for Python and OpenSSL before installing or upgrading anything, because the detection can come from a runtime or library bundled inside another application rather than a separately installed Python/OpenSSL package.

1. Find the detected version and path

In the Azure portal:

1. Go to Microsoft Defender for Cloud → Inventory.
2. Search for and select EAPDashboardVM.
3. Open Installed applications.
4. Search for Python and OpenSSL.
5. Select each result and inspect:
   • Version
   • Evidence — file paths, registry paths, or both
   • Known vulnerabilities

The Installed applications view displays detection evidence when available and requires Defender CSPM agentless scanning, Defender for Servers Plan 2 agentless scanning, or Defender for Endpoint integration.^1^

Also check the Defender portal:

1. Go to Assets → Devices.
2. Select the VM and then Inventories → Software.
3. Open the Python or OpenSSL entry.
4. Review Software Evidence for its disk and registry paths.^2^

For OpenSSL specifically, go to Exposure Management → Vulnerability Management → Inventories → Software components, select OpenSSL, and inspect Vulnerable files. This view provides vulnerable file paths, versions, related vulnerabilities, and exposed devices.^3^

2. If the UI still omits the path

If Defender for Endpoint is deployed on this VM, run this in Microsoft Defender portal → Hunting → Advanced hunting:

DeviceTvmSoftwareEvidenceBeta
| where SoftwareName contains "python"
    or SoftwareName contains "openssl"
| mv-expand DiskPath = DiskPaths
| mv-expand RegistryPath = RegistryPaths
| project DeviceId, SoftwareVendor, SoftwareName,
          SoftwareVersion, DiskPath, RegistryPath, LastSeenTime
| order by LastSeenTime desc

DeviceTvmSoftwareEvidenceBeta exposes the detected software version plus DiskPaths and RegistryPaths. It is a beta table, is populated by Defender for Endpoint, and must be queried in Defender XDR Advanced Hunting—not Microsoft Sentinel.^4^

To export the detected and fixed versions from Defender for Cloud, open Azure Resource Graph Explorer and run:

securityresources
| where type == "microsoft.security/assessments"
| where properties.resourceDetails.ResourceType =~ "microsoft.compute/virtualmachines"
| where properties.metadata.recommendationCategory == "SoftwareUpdate"
| extend DetectedVersion =
    tostring(properties.additionalData.DetectedSoftwareVersions)
| extend FixedVersion = tostring(properties.additionalData.FixedVersion)
| where properties.displayName has_any ("python", "openssl")
| project properties.displayName, DetectedVersion, FixedVersion

Microsoft documents these assessment fields for exporting VM software-update findings.^5^

3. Remediate the owning component

Act according to the evidence path:

• Standalone Python/OpenSSL installation: update it to at least the finding’s fixed version, or remove it if confirmed unused.
• File inside another product directory: update or remove the owning application. Do not replace an embedded DLL or runtime independently unless that product’s vendor explicitly supports it.
• Deployment artifact, service directory, or pipeline output: update the dependency in the deployment source and redeploy, so the vulnerable copy is not restored.
• Multiple paths: remediate every detected copy.

Review Associated CVEs and the individual vulnerability details before selecting a target version. Defender’s vulnerability workflow provides the affected resource, CVEs, remediation guidance, and supporting information where available.^5^

After remediation and a fresh device report, Defender Vulnerability Management typically updates within 24–48 hours.^6^

4. If no evidence exists or the files are absent

Do not install Python or OpenSSL merely to satisfy the recommendation. Instead:

1. Open the affected vulnerability or security recommendation.
2. Select Report inaccuracy.
3. Choose the category indicating that the software is not installed, the evidence is wrong, or the recommendation is already remediated.
4. Include the VM name, CVEs, scan time, and results of the inventory/evidence checks.

Defender supports reporting vague, incomplete, inaccurate, or already-remediated findings.^6^

If the detection is valid but cannot currently be remediated—for example, the library is embedded in a vendor product with no fixed release—an appropriately authorized security administrator can use Exception options. An exception suppresses the recommendation; it does not patch the vulnerability.^7^

---

References

1. Use cloud asset inventory
2. Software inventory
3. Software components in Microsoft Defender Vulnerability Management
4. DeviceTvmSoftwareEvidenceBeta
5. Remediate machine vulnerabilities
6. Vulnerabilities in my organization
7. Security recommendations