Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

How to consume and export scan results

4 September 2026Doc update+50 / −44 lines

In brief

The documentation now directs administrators to the Recommendations page, filter Scanner to SQL Vulnerability Assessment, and use the selected recommendations view. The Resource Graph Explorer example now queries assessments, filters by scanner, and uses updated result fields.

What Defender admins need to know

Administrators querying or exporting SQL vulnerability findings should follow the revised navigation steps and Kusto query structure.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Query and export findings in ARG with Defender for Cloud

Use this methodthe Defender for Cloud Recommendations page to query findings from Defender for Cloudin Azure Resource Graph (ARG) and export results for reporting.

To query and export your findings with ARG with Defender for Cloud:

  1. Navigate to Microsoft Defender for Cloud > Recommendations.

  2. Search for and select either:

    • For Azure Set the Scanner filter to SQL databases - SQL databases should have vulnerability findings resolvedVulnerability Assessment.

    • For SQL servers on machines - SQL servers on machines should have vulnerability findings resolved.

  3. Select Open Query.

  4. Select either:

    • Query returning affected resources - Returns a list of the resources that are currently affected (recommendation status per resource).
    • Query returning security findings - Returns a list of all security findings (findings and subassessments aggregated per applicable resources).

    :::image type="content" source="media/defender-for-sql-scan-results/open-query-options.png" alt-text="Screenshot of the Recommendations page, with the Open query dropdown indicated in the upper-left. The dropdown shows two options: query returning affected resource and query returning security findings." lightbox="media/defender-for-sql-scan-results/open-query-options.png":::

  5. Select Run query.

  6. Select Download as CSV.

The query changes based on the recommendations view you've selected.

:::image type="content" source="media/defender-for-sql-scan-results/select-recommendations-view.png" alt-text="Screenshot of the recommendation view options with By Title selected." lightbox="media/defender-for-sql-scan-results/select-recommendations-view.png":::

These queries are editable. You can customize them for a specific resource, a set of findings, or a finding status.

Query and export findings in ARG

Use this method to query findings directly in Resource Graph Explorer

Use Resource Graph Explorer to query findings directly when you need advanced query customization.

To query and export your findings with ARG:

  1. Edit and enter the following query. Replace the placeholders in the resourceId filter with the resource ID of your SQL database: 

    securityresources
| where type =~ "microsoft.security/assessments/subassessmentsassessments"
| extend assessmentKey=extract(@"(?i)providers/Microsoft.Security/assessments/([^/]*)", 1, id), subAssessmentId=tostring(properties.id), parentResourceId= extract("(.+)/providers/Microsoft.Security", 1, id)
| extend resourceIdTemp = iff(properties.resourceDetails.id != "", properties.resourceDetails.id, extract("(.+)/providers/Microsoft.Security", 1, id))
| extend scanner = (// AssessmentsQueryBuilder.columnDefinitions.scanner
(tostring(
coalesce(bag_keys(parse_json(tostring(properties.additionalData.ScannersDetails)))[0], bag_keys(parse_json(tostring(properties.additionalData.ScannersDetails)))[0],
properties.additionalData.scanner, properties.additionalData.scanner,
properties.additionalData.Scanner, properties.additionalData.Scanner,
properties.additionalData.SecretScannerName, properties.additionalData.SecretScannerName,
properties.additionalData.ToolName, properties.additionalData.ToolName,
properties.additionalData.ScannerName, properties.additionalData.ScannerName,
todynamic("N/A")))))
| where scanner in~ ("SQL Vulnerability Assessment")
| extend resourceId = iff(properties.resourceDetails.source =~ "OnPremiseSql", strcat(resourceIdTemp, "/servers/", properties.resourceDetails.serverName, "/databases/" , properties.resourceDetails.databaseName), resourceIdTemp)
| where resourceId =~ "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Sql/servers/<server-name>/databases/<database-name>"
| where assessmentKey =~ "82e20e14-edc5-4373-bfc4-f13121257c37"
| project resourceId,
subscriptionId,
assessmentKey,
subAssessmentId,RuleId=properties.additionalData.ruleId,
name=properties.displayName,
description=properties.metadata.description,
severity=properties.status.additionalData.severity,
status=properties.status.code,
cause=properties.status.cause,
category=properties.additionalData.category,
impact=properties.additionalData.impact,
remediation=properties.remediation,metadata.remediationDescription,
benchmarks=properties.additionalData.benchmarksbenchmarks,
scanner,
HasBaseline=properties.additionalData.hasBaseline

  2. Select Run query.

  3. Select Download as CSV.

    :::image type="content" source="media/defender-for-sql-scan-results/run-and-download.png" alt-text="Screenshot of Resource Graph Explorer page with Run query and Download as CSV controls highlighted." lightbox="media/defender-for-sql-scan-results/run-and-download.png":::

ThisThe Resource Graph Explorer query is editable. You can customize it for a specific resource, a set of findings, or a finding status.

Open a Queryquery from your SQL database

Use this methodthe SQL database resource page to query vulnerability findings for a specific SQL database from the database resource page.database.

To open a query from your SQL database: 

:::image type="content" source="media/defender-for-sql-scan-results/run-and-download.png" alt-text="Screenshot of Resource Graph Explorer page with Run query and Download as CSV controls highlighted." lightbox="media/defender-for-sql-scan-results/run-and-download.png":::

ThisThe query opened from the SQL database resource page is editable. You can customize it for a specific resource, a set of findings, or a finding status.

Automate email notifications with Logic Apps