Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Identify Sql Servers Protected By Monitor Agent

16 October 2026Doc update+30 / −10 lines

In brief

The documented KQL now queries SQL Vulnerability Assessment records, filters resources by Log Analytics workspace IDs, and returns workspace ID, machine name, and machine UUID. The prior subassessment, OnPremiseSql, and 30-day scan-time filters were removed.

What Defender admins need to know

Administrators using this query should review their saved version because its filtering logic and output fields have changed.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  1. Copy and paste the following query into the query window:

    securityresources
    | where type ===~ "microsoft.security/assessments/subassessmentsassessments"
    | extend assessmentKeyscanner = extract(@(// AssessmentsQueryBuilder.columnDefinitions.scanner
            (tostring(
        coalesce(bag_keys(parse_json(tostring(properties.additionalData.ScannersDetails)))[0], bag_keys(parse_json(tostring(properties.additionalData.ScannersDetails)))[0],
        properties.additionalData.scanner, properties.additionalData.scanner,
        properties.additionalData.Scanner, properties.additionalData.Scanner,
        properties.additionalData.SecretScannerName, properties.additionalData.SecretScannerName,
        properties.additionalData.ToolName, properties.additionalData.ToolName,
        properties.additionalData.ScannerName, properties.additionalData.ScannerName,
        "N/A"))))
                    | where scanner in~ (?i)"SQL Vulnerability Assessment")
    | extend source = (// AssessmentsQueryBuilder.columnDefinitions.source
            (trim(' ', tolower(coalesce(tostring(properties.resourceDetails.Source), tostring(properties.resourceDetails.source))))))
    | extend resourceId = (// AssessmentsQueryBuilder.columnDefinitions.resourceId
            (tolower(trim(" ", tostring(case(source =~ "azure", coalesce(properties.resourceDetails.Id, properties.resourceDetails.id),
        (// AssessmentsQueryBuilder.predicates.newAwsAssessmentIndicator
        (source =~ "aws" and isnotempty(tostring(properties.resourceDetails.ConnectorId)))), coalesce(properties.resourceDetails.Id, properties.resourceDetails.id),
        (// AssessmentsQueryBuilder.predicates.newGcpAssessmentIndicator
        (source =~ "gcp" and isnotempty(tostring(properties.resourceDetails.ConnectorId)))), coalesce(properties.resourceDetails.Id, properties.resourceDetails.id),
        source =~ "aws", properties.resourceDetails.AzureResourceId,
        source =~ "gcp", properties.resourceDetails.AzureResourceId,
        split(id, "/providers/Microsoft.Security/assessments/(")[^/]*0]
        )))", 1, id))))
    | where assessmentKey ==resourceId contains "f97aa83c-9b63-4f9a-99f6-b22c4398f936"
| where tostring(properties.resourceDetails.source) == "OnPremiseSqlmicrosoft.operationalinsights"
    | extend lastScanTimeworkspaceId = todatetime(tostring(properties.timeGenerated)
| where lastScanTime > ago(30d)resourceDetails.WorkspaceId)
    | extend machineName = tostring(properties.resourceDetails.machineName)MachineName)
    | extend machineUuid = tostring(properties.resourceDetails.vmuuid)VMUUID)
    | distinct workspaceId, machineName, machineUuid

  2. Select Run query.