SI-2 on Microsoft Sentinel

What this finds

An asset still reports an active finding for a CVE in CISA's Known Exploited Vulnerabilities catalogue, after the remediation date CISA published for that entry.

The requirement

The organization must identify, report, and correct information system flaws, and install security-relevant updates within an organization-defined time period of their release.

NIST SP 800-53 Rev. 5 — SI-2 (Flaw Remediation).

NIST requires flaws to be corrected within a period the organization defines. This pack does not attempt to judge every CVE. It narrows to CISA's Known Exploited Vulnerabilities catalogue — the subset with confirmed exploitation in the wild — and reports the ones still present after the remediation date CISA published. Which asset population is in scope, and whether a compensating control justifies an exception, remain organization-defined.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

• 2.B — Mitigate known vulnerabilities
  The goal is mitigating known vulnerabilities; the pack finds entries from CISA's own Known Exploited Vulnerabilities catalogue still active past the remediation date CISA published for them.
• 2.A — Manage organizational assets (partial — see note)
  Reaches the asset inventory only through whatever the vulnerability scanner already covers. An asset the scanner never sees produces no row here, so CM-8 rather than this pack is what evidences inventory completeness.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

The query

Published as si-2-kev-overdue.azure.kql. Reads DeviceTvmSoftwareVulnerabilities (Defender Vulnerability Management), KevCatalog (supplied). Requires: Log Analytics Reader.

Before this returns anything, DeviceTvmSoftwareVulnerabilities (Defender Vulnerability Management) has to be reaching Microsoft Sentinel / Log Analytics, and KevCatalog (supplied) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

// SI-2 -- known-exploited vulnerabilities still present past CISA's due date
// Requires the kev_catalog contract landed as the KevCatalog watchlist.
let GraceDays = 0;
let Kev = _GetWatchlist('KevCatalog')
    | project KevCve  = toupper(tostring(cve_id)),
              DueDate = todatetime(due_date),
              KevProduct = tostring(product);
DeviceTvmSoftwareVulnerabilities
| where TimeGenerated > ago(7d)
| summarize arg_max(TimeGenerated, *) by DeviceId, CveId
| project DeviceId, DeviceName, SoftwareVendor, SoftwareName,
          KevCve = toupper(tostring(CveId)), VulnerabilitySeverityLevel
| join kind=inner Kev on KevCve
// Overdue is the finding. A KEV entry inside its remediation window is not.
| where DueDate < ago(GraceDays * 1d)
| extend DaysOverdue = datetime_diff('day', now(), DueDate)
| project DeviceId, DeviceName, SoftwareVendor, SoftwareName,
          KevCve, KevProduct, VulnerabilitySeverityLevel, DueDate, DaysOverdue
| order by DaysOverdue desc, DeviceName asc

Open this pack on Microsoft Sentinel to adjust the settings and download it →

The interactive version opens on Microsoft Sentinel — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Grace period after the due date (days) (default 0)

Findings are only reported once this many days have passed beyond CISA's published remediation date. Zero means the published date is the deadline.

Limit to specific assets (optional)

Paste device identifiers, one per line.

Running it continuously

Sentinel scheduled analytics rule

Rule type:        Scheduled query rule
Run frequency:    Every 12 hours
Lookup period:    Last 7 days
Trigger:          Number of query results > 0
Entity mapping:   Host -> DeviceName
Severity:         High
MITRE tactic:     Initial Access (T1190 Exploit Public-Facing Application)
Incident:         Create incident, group alerts by Host entity
Suppression:      24 hours per device and CVE

Grouping by host rather than by CVE means one incident per affected machine, which is the unit somebody can actually be assigned to patch.

Before you act on a result

• Is the KEV catalogue copy current? CISA adds entries continuously, and a stale file narrows this query silently.
• Has the vulnerability been mitigated in a way the scanner cannot see, such as removing the affected component from the network path?
• Is the asset in scope for patching at all, or is it a decommissioned system still reporting?
• Does a documented compensating control with an expiry cover this, and has that expiry passed?
• Is the scanner's coverage complete for this asset population, or would an unscanned host show nothing here regardless?

Common questions

How do I check for known-exploited vulnerability past its remediation date in Microsoft Sentinel?

Run the published KQL query on this page against Microsoft Sentinel / Log Analytics. It reads DeviceTvmSoftwareVulnerabilities (Defender Vulnerability Management), KevCatalog (supplied) and reports: An asset still reports an active finding for a CVE in CISA's Known Exploited Vulnerabilities catalogue, after the remediation date CISA published for that entry.

What permissions are needed to run this Microsoft Sentinel query?

Log Analytics Reader.

What evidence does SI-2 need that Microsoft Sentinel cannot produce?

Known Exploited Vulnerabilities catalog (kev_catalog.csv). CISA's catalogue of vulnerabilities with confirmed exploitation in the wild, joined to your own vulnerability findings so SI-2 reports the ones that are actually being used against organizations rather than everything with a CVE. Download it from CISA rather than typing it: the authoritative CSV is published at https://www.cisa.gov/known-exploited-vulnerabilities-catalog and is a US federal work in the public domain. At minimum it must carry: cve_id, due_date.

Does a result from this query mean the control has failed?

A KEV entry past its due date does not establish that the vulnerability was exploited in your environment, or that exploitation is possible given your configuration. It establishes that a vulnerability confirmed to be exploited elsewhere is still reported as present after the date the federal catalogue set for fixing it. Scanner coverage gaps mean the absence of rows is not evidence of the absence of the condition.

The same control on other platforms

• SI-2 on AWS — SQL (Athena) + Lambda
• SI-2 on Splunk — SPL
• All platforms for SI-2