Is there a KQL query to get a list of VMs which are not patched since last month. Below is the sample I have

| where Classification in ("Security Updates", "Critical Updates")
| where UpdateState == 'Needed' and Optional == false and Approved == true
| summarize count() by Classification, Computer, _ResourceId
// This query requires the Security or Update solutions

How to apply the filter to just show the ones which are due since one month

1 Answer 1


I was able to achieve that

//|where OSType != "Linux" and UpdateState == "Needed" and Optional == "false"
| where Classification in ("Security Updates", "Critical Updates") 
| where PublishedDate <= ago(30d)
| where startofday(TimeGenerated) == startofday(now())
| project TimeGenerated, Computer, Title, KBID, Classification, MSRCSeverity, PublishedDate, _ResourceId
| sort by TimeGenerated desc
| summarize any(KBID) by KBID, Title, Computer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.