Endpoint and container validation

Latest accessible DeviceInfo record per device in 30 days, filtered to Linux after deduplication. LastSeen and sensor health are inventory signals, not an AV test or container inventory. Devices absent from this discovery are unknown; reconcile separately against your authoritative asset list.

DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OSPlatform =~ "Linux"
| project DeviceId, DeviceName, LastSeen=Timestamp, OSPlatform, OSDistribution,
          OnboardingStatus, SensorHealthState, MergedToDeviceId, AzureResourceId
| order by DeviceName asc

Samples recent processes from accessible Linux devices, not just known runtime names. A process name or Docker parent is not native pod/image enrichment. Correlate a known benign execution with full runtime container identity and UTC before claiming container attribution. This is telemetry, not an alert.

DeviceProcessEvents
| where Timestamp > ago(1d)
| join kind=inner (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | where OSPlatform =~ "Linux"
    | project DeviceId
) on DeviceId
| project Timestamp, DeviceId, DeviceName, FileName, ProcessId,
          ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine, AdditionalFields, ReportId
| order by Timestamp desc
| take 200

Retains service and detection source; never relabel an MDE alert as Defender for Containers merely because Defender for Cloud displays it. This device-linked view does not discover every cloud-only alert. XDR AlertId is not assumed equal to an ARM alert resource ID.

AlertInfo
| where Timestamp > ago(7d)
| summarize arg_max(Timestamp, *) by AlertId
| join kind=inner (
    AlertEvidence
    | where Timestamp > ago(7d)
    | join kind=inner (
        DeviceInfo
        | where Timestamp > ago(30d)
        | summarize arg_max(Timestamp, *) by DeviceId
        | where OSPlatform =~ "Linux"
        | project DeviceId
    ) on DeviceId
    | distinct AlertId, DeviceId, DeviceName
) on AlertId
| project Timestamp, DeviceId, DeviceName, AlertId, Title, Severity,
          ServiceSource, DetectionSource, Category
| order by Timestamp desc
| take 200

Latest assessment per device/control is selected BEFORE applicability or compliance filtering. Counts cover assessments visible within 30 days; missing or stale devices are unknown, not compliant. Host control findings are not Kubernetes or container configuration findings.

DeviceTvmSecureConfigurationAssessment
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
| join kind=inner (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | where OSPlatform =~ "Linux"
    | project DeviceId
) on DeviceId
| summarize Assessed=count(), Applicable=countif(IsApplicable == true),
            NonCompliant=countif(IsApplicable == true and IsCompliant == false),
            LastAssessmentUtc=max(Timestamp) by DeviceId, DeviceName
| extend QueryUtc=now()
| order by DeviceName asc

Latest-before-filter prevents old failed states from overriding a newer compliant assessment. Knowledge-base joins describe the control and remediation; nothing is changed. No rows may mean no applicable failures, missing assessments, licensing or RBAC; cross-check Q01 and Q04. These are not insecure-container controls.

DeviceTvmSecureConfigurationAssessment
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
| where IsApplicable == true and IsCompliant == false
| join kind=inner (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | where OSPlatform =~ "Linux"
    | project DeviceId
) on DeviceId
| join kind=leftouter (
    DeviceTvmSecureConfigurationAssessmentKB
    | project ConfigurationId, ConfigurationName, ConfigurationDescription,
              RiskDescription, RemediationOptions
) on ConfigurationId
| project AssessmentUtc=Timestamp, DeviceId, DeviceName, ConfigurationId,
          ConfigurationCategory, ConfigurationSubcategory, ConfigurationName,
          ConfigurationDescription, RiskDescription, RemediationOptions
| order by DeviceName asc, ConfigurationId asc

Snapshot software table has no Timestamp. DeviceInfo alone uses a 30-day discovery window. VulnerabilityRows counts package/version/CVE rows, not unique CVEs; ApproxDistinctCves is the approximate dcount per device, not additive across devices. Devices missing from this snapshot are unknown, not necessarily free of CVEs. QueryUtc is query time, not assessment time.

DeviceTvmSoftwareVulnerabilities
| join kind=inner (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | where OSPlatform =~ "Linux"
    | project DeviceId
) on DeviceId
| summarize VulnerabilityRows=count(), ApproxDistinctCves=dcount(CveId),
            ExampleCves=make_set(CveId, 5) by DeviceId, DeviceName
| extend QueryUtc=now()
| order by DeviceName asc

Discovers accessible cloud process events without fixed cluster or namespace filters. Requires the supported runtime collection and XDR integration; MDE alone does not populate this table. Government Arc sensor exclusions still apply. Empty or unavailable data is not clean posture and does not override documented support boundaries.

CloudProcessEvents
| where Timestamp > ago(7d)
| project Timestamp, AzureResourceId, AwsResourceName, GcpFullResourceName,
          HostName, KubernetesNamespace, KubernetesPodName,
          ContainerId, ContainerName, ContainerImageName, ImageDigest,
          ProcessName, ProcessCommandLine, AgentId
| order by Timestamp desc
| take 200

Run in the intended workspace(s). Requires supported Container insights streams and DCR association, independently of MDE. Join on normalized resource + computer + normalized FULL container ID, never a prefix. Missing image-side rows remain visible. ImageID is not assumed to equal a registry manifest digest; this is monitoring inventory, not detection.

KubePodInventory
| where TimeGenerated > ago(2h)
| where isnotempty(ContainerID) and isnotempty(_ResourceId) and isnotempty(Computer)
| extend Scope=tolower(_ResourceId), Computer=tolower(Computer),
         RuntimeId=tolower(replace_regex(ContainerID, @"^[^:]+://", ""))
| summarize arg_max(TimeGenerated, *) by Scope, Computer, RuntimeId
| project Scope, Computer, RuntimeId, PodSeen=TimeGenerated,
          Namespace, PodName=Name, PodUid, ContainerName, ContainerStatus
| join kind=leftouter (
    ContainerInventory
    | where TimeGenerated > ago(2h)
    | where isnotempty(ContainerID) and isnotempty(_ResourceId) and isnotempty(Computer)
    | extend Scope=tolower(_ResourceId), Computer=tolower(Computer),
             RuntimeId=tolower(replace_regex(ContainerID, @"^[^:]+://", ""))
    | summarize arg_max(TimeGenerated, *) by Scope, Computer, RuntimeId
    | project Scope, Computer, RuntimeId, ImageSeen=TimeGenerated,
              Image, ImageID, ImageTag, Repository
) on Scope, Computer, RuntimeId
| project Scope, PodSeen, ImageSeen, Computer, Namespace, PodName, PodUid,
          RuntimeId, ContainerName, ContainerStatus, Image, ImageID, ImageTag, Repository
| order by PodSeen desc
| take 500

Discovery covers selected subscriptions and RBAC. Inspect AssessedResourceType and AdditionalData before interpreting any row as ACR VA; projected image/package fields use the observed artifactDetails/softwareDetails/vulnerabilityDetails schema and can be blank for other versions/types. This sampled output is not a CVE total. After schema discovery, narrow to your registry and immutable digest. Registry VA requires no endpoint inside the image and no running workload; it does not prove AWS agentless support.

securityresources
| where type =~ "microsoft.security/assessments/subassessments"
| extend Details=properties.additionalData
| extend AssessedResourceType=tostring(Details.assessedResourceType),
         Digest=tostring(Details.artifactDetails.digest),
         Registry=tostring(Details.artifactDetails.registryHost)
| project AssessmentId=id, subscriptionId, resourceGroup, AssessedResourceType,
          DisplayName=tostring(properties.displayName), Status=tostring(properties.status.code),
          CVE=tostring(Details.vulnerabilityDetails.cveId),
          Severity=tostring(Details.vulnerabilityDetails.severity), Digest, Registry,
          Repository=tostring(Details.artifactDetails.repositoryName),
          Package=tostring(Details.softwareDetails.packageName),
          Installed=tostring(Details.softwareDetails.version),
          Fixed=tostring(Details.softwareDetails.fixedVersion),
          FixStatus=tostring(Details.softwareDetails.fixStatus), AdditionalData=Details
| order by AssessedResourceType asc, Registry asc, Digest asc
| take 500

Extracts a candidate container ID from an observed containerd parent working-directory path. This is a heuristic, not a native ContainerId field or complete inventory; verify against the runtime's actual container ID and execution time. The path alone can be imitated and does not supply pod, image digest, image CVEs or a security alert. Runtime/layout differences and missing event context can produce no rows. Results are a 200-row sample.

DeviceProcessEvents
| where Timestamp > ago(1d)
| extend HostContext=parse_json(AdditionalFields)
| extend RuntimeWorkingDirectory=tostring(HostContext.InitiatingProcessCurrentWorkingDirectory)
| extend DerivedContainerId=extract(@"/(?:k8s[.]io|moby)/([0-9a-f]{64})/rootfs(?:/|$)", 1, RuntimeWorkingDirectory)
| where isnotempty(DerivedContainerId)
| project Timestamp, DeviceId, DeviceName, FileName, ProcessId,
          DerivedContainerId, RuntimeWorkingDirectory, ProcessCommandLine, ReportId
| order by Timestamp desc
| take 200

Latest accessible DeviceInfo record per device in 30 days, without an OS filter; includes Windows and any reported WSL logical devices. OS fields may initially be empty. Onboarding and sensor health are inventory signals, not proof of host AV or WSL runtime protection. Reconcile identity and freshness with local evidence; the 500-row cap is a sample, not a complete inventory.

DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| project LastSeen=Timestamp, DeviceId, DeviceName, OSPlatform, OSDistribution,
          OnboardingStatus, SensorHealthState
| order by LastSeen desc, DeviceId asc
| take 500

Searches the previous day for a deliberately generated benign WSL_VALIDATION command-line marker without an OS filter. Correlate the event time, device identity and process/parent context with the actual WSL execution; a Windows launcher or copied marker alone does not prove guest telemetry or container attribution. These are process events, not AV or behavioral alerts. Zero rows can reflect no marker execution, ingestion delay, RBAC or collection gaps; the 200-row cap is a sample.

DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine contains "WSL_VALIDATION"
| project Timestamp, DeviceId, DeviceName, FileName, ProcessId,
          ProcessCommandLine, InitiatingProcessId, InitiatingProcessFileName,
          InitiatingProcessCommandLine, AdditionalFields, ReportId
| order by Timestamp desc
| take 200

Uses Microsoft's documented native HostDeviceId relationship, not the heuristic runtime-container IDs derived by Q18. Selects the latest record per device within 30 days before filtering Linux WSL records, then left-joins the reported host ID to latest accessible host inventory. Missing host fields can reflect RBAC, stale data or ingestion gaps; zero rows do not disprove local guest execution. This relationship is not a protection test, per-distro inventory or container attribution. Bounded to 500 rows.

DeviceInfo
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by DeviceId
| where OSPlatform =~ "Linux" and isnotempty(HostDeviceId)
| project WSLDeviceId=DeviceId, WSLDeviceName=DeviceName, WSLLastSeen=Timestamp,
          HostDeviceId, WSLOnboardingStatus=OnboardingStatus, WSLSensorHealth=SensorHealthState
| join kind=leftouter (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | project HostDeviceId=DeviceId, HostDeviceName=DeviceName, HostOSPlatform=OSPlatform,
              HostLastSeen=Timestamp, HostOnboardingStatus=OnboardingStatus, HostSensorHealth=SensorHealthState
) on HostDeviceId
| project WSLLastSeen, WSLDeviceId, WSLDeviceName, WSLOnboardingStatus, WSLSensorHealth,
          HostDeviceId, HostDeviceName, HostOSPlatform, HostLastSeen, HostOnboardingStatus, HostSensorHealth
| order by WSLLastSeen desc, WSLDeviceId asc
| take 500

Cross-platform host summary with separate metric rows. Software vulnerabilities are a current snapshot without a Timestamp filter: counts are software/package/CVE rows, not distinct CVEs. Configuration assessments use the latest device/control record within 30 days before counting applicability and failure. Empty metric columns mean not applicable to that metric row, not zero findings. Devices without TVM rows are absent, not proven secure; WSL logical-device TVM is documented unavailable. No complete asset inventory, remediation, container-image scan or secure posture is implied. Output is capped at 500 metric rows.

union
(
    DeviceTvmSoftwareVulnerabilities
    | summarize VulnerabilityRows=count() by DeviceId
    | extend Metric="Host software vulnerabilities"
),
(
    DeviceTvmSecureConfigurationAssessment
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
    | summarize Assessed=count(), Applicable=countif(IsApplicable == true),
                NonCompliant=countif(IsApplicable == true and IsCompliant == false),
                LastAssessmentUtc=max(Timestamp) by DeviceId
    | extend Metric="Host configuration assessments"
)
| join kind=leftouter (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | project DeviceId, DeviceName, OSPlatform, OSDistribution, LastSeen=Timestamp
) on DeviceId
| project DeviceId, DeviceName, OSPlatform, OSDistribution, LastSeen, Metric,
          VulnerabilityRows, Assessed, Applicable, NonCompliant, LastAssessmentUtc
| order by DeviceName asc, DeviceId asc, Metric asc
| take 500

Samples file events for the controlled WSL_VALIDATION_FILE_METADATA.txt marker over one day without private IDs. Correlate device identity, time and initiating process with the known local container test. FileDeleted alone does not prove FileCreated was captured; an empty SHA256 is not a cloud hash match. No native image identity, complete file coverage, antivirus detection or behavioral alert is implied.

DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName == "WSL_VALIDATION_FILE_METADATA.txt"
| project Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath,
          SHA256, InitiatingProcessId, InitiatingProcessFileName, AdditionalFields
| order by Timestamp asc
| take 200

Samples one day of network events for latest Linux DeviceInfo records with native HostDeviceId. Correlate process, time and socket fields with the controlled workload; this identifies WSL devices, not native Docker image/container identity. Missing addresses or zero ports require interpretation, not invented enrichment. Host curl and container nginx events are different observations. No network blocking, complete connection inventory or behavioral alert is proven. Limited to 200 rows.

DeviceNetworkEvents
| where Timestamp > ago(1d)
| join kind=inner (
    DeviceInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp, *) by DeviceId
    | where OSPlatform =~ "Linux" and isnotempty(HostDeviceId)
    | project DeviceId, HostDeviceId
) on DeviceId
| project Timestamp, DeviceId, DeviceName, HostDeviceId, ActionType,
          LocalIP, LocalPort, RemoteIP, RemotePort, Protocol,
          InitiatingProcessFileName, InitiatingProcessId,
          InitiatingProcessCommandLine, AdditionalFields
| order by Timestamp desc
| take 200

Prerequisite: run an authorized benign process and unique temporary-file probe using the AWS_FINAL_VALIDATION_ prefix inside a known container, then correlate exact command, filename and execution time. One-hour window, oldest-first 200-row cap; includes host launchers, not just in-container events. Device association and markers are not native container/image identity. Some process/file visibility does not prove complete inventory, antivirus interception, behavioral alerts or DfC coverage. Blank parent fields must not be inferred.

union
(DeviceProcessEvents | where Timestamp > ago(1h) | where ProcessCommandLine contains "AWS_FINAL_VALIDATION_" | extend EventTable="DeviceProcessEvents" | project EventTable, Timestamp, DeviceId, FileName, ProcessCommandLine, ProcessId, InitiatingProcessFileName, ActionType, AdditionalFields),
(DeviceFileEvents | where Timestamp > ago(1h) | where FileName startswith "AWS_FINAL_VALIDATION_" | extend EventTable="DeviceFileEvents" | project EventTable, Timestamp, DeviceId, FileName, FolderPath, InitiatingProcessFileName, ActionType, AdditionalFields)
| order by Timestamp asc
| take 200