{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "slug": "dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields", "url": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/" }, "title": "Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data", "summary": "Why can a subscription-scoped Defender recommendation query miss CVSS and CVE publication details?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:22+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 238, "potentially_affected": "Azure Resource Graph integrations enriching Defender for Cloud individual recommendations with microsoft.security/cvedetails.", "dse_recommendation": "Separate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly.", "primary_source": { "name": "Transition from grouped to individual recommendations in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In Defender for Cloud’s individual-recommendation schema, CvesDetails retains each vulnerability’s CveId. Additional information is available through the microsoft.security/cvedetails resource type. Microsoft requires tenant scope for that query: subscription scope returns no records from this type, so enrichment fields such as LatestPublishedDate, LastModifiedDate and CVSSScore are not returned there. Microsoft Learn.

\n

Applicability

\n

This concerns an Azure Resource Graph enrichment pipeline, not the meaning of a CVSS score or the priority of a particular vulnerability. A report may need to distinguish finding data from the separately retrieved CVE details.

\n

DSE recommendation

\n

Separate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly. Preserve the CVE identifier even when the enrichment stage supplies no matching details. Have the integration owner record the scope used for each request and avoid converting a missing score into a numeric zero. Do not expand query authority merely to conceal an unexamined empty result.

\n

Verification

\n

With authorized read access, select a known finding and compare its CVE identifier with the tenant-scoped details result. Inspect the report’s behavior when enrichment is unavailable: the finding should remain visible with the uncertainty expressed. Review joins and any date or score filters so absent enrichment cannot silently remove findings from the intended report. Retain the request scopes and representative sanitized output as evidence of the data contract, without asserting that all tenant vulnerabilities were assessed.

\n

Official references

\n

Microsoft Learn: Individual recommendation transition. Source reviewed September 9, 2026.

", "content_text": "Source facts\nIn Defender for Cloud’s individual-recommendation schema, CvesDetails retains each vulnerability’s CveId. Additional information is available through the microsoft.security/cvedetails resource type. Microsoft requires tenant scope for that query: subscription scope returns no records from this type, so enrichment fields such as LatestPublishedDate, LastModifiedDate and CVSSScore are not returned there. Microsoft Learn.\nApplicability\nThis concerns an Azure Resource Graph enrichment pipeline, not the meaning of a CVSS score or the priority of a particular vulnerability. A report may need to distinguish finding data from the separately retrieved CVE details.\nDSE recommendation\nSeparate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly. Preserve the CVE identifier even when the enrichment stage supplies no matching details. Have the integration owner record the scope used for each request and avoid converting a missing score into a numeric zero. Do not expand query authority merely to conceal an unexamined empty result.\nVerification\nWith authorized read access, select a known finding and compare its CVE identifier with the tenant-scoped details result. Inspect the report’s behavior when enrichment is unavailable: the finding should remain visible with the uncertainty expressed. Review joins and any date or score filters so absent enrichment cannot silently remove findings from the intended report. Retain the request scopes and representative sanitized output as evidence of the data contract, without asserting that all tenant vulnerabilities were assessed.\nOfficial references\nMicrosoft Learn: Individual recommendation transition. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nIn Defender for Cloud’s individual-recommendation schema, CvesDetails retains each vulnerability’s CveId. Additional information is available through the microsoft.security/cvedetails resource type. Microsoft requires tenant scope for that query: subscription scope returns no records from this type, so enrichment fields such as LatestPublishedDate, LastModifiedDate and CVSSScore are not returned there. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations).\n\n## Applicability\n\nThis concerns an Azure Resource Graph enrichment pipeline, not the meaning of a CVSS score or the priority of a particular vulnerability. A report may need to distinguish finding data from the separately retrieved CVE details.\n\n## DSE recommendation\n\nSeparate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly. Preserve the CVE identifier even when the enrichment stage supplies no matching details. Have the integration owner record the scope used for each request and avoid converting a missing score into a numeric zero. Do not expand query authority merely to conceal an unexamined empty result.\n\n## Verification\n\nWith authorized read access, select a known finding and compare its CVE identifier with the tenant-scoped details result. Inspect the report’s behavior when enrichment is unavailable: the finding should remain visible with the uncertainty expressed. Review joins and any date or score filters so absent enrichment cannot silently remove findings from the intended report. Retain the request scopes and representative sanitized output as evidence of the data contract, without asserting that all tenant vulnerabilities were assessed.\n\n## Official references\n\n[Microsoft Learn: Individual recommendation transition](https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "url": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data", "item": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "url": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/", "headline": "Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data", "description": "Why can a subscription-scoped Defender recommendation query miss CVSS and CVE publication details?", "abstract": "Why can a subscription-scoped Defender recommendation query miss CVSS and CVE publication details?", "articleBody": "Source facts\nIn Defender for Cloud’s individual-recommendation schema, CvesDetails retains each vulnerability’s CveId. Additional information is available through the microsoft.security/cvedetails resource type. Microsoft requires tenant scope for that query: subscription scope returns no records from this type, so enrichment fields such as LatestPublishedDate, LastModifiedDate and CVSSScore are not returned there. Microsoft Learn.\nApplicability\nThis concerns an Azure Resource Graph enrichment pipeline, not the meaning of a CVSS score or the priority of a particular vulnerability. A report may need to distinguish finding data from the separately retrieved CVE details.\nDSE recommendation\nSeparate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly. Preserve the CVE identifier even when the enrichment stage supplies no matching details. Have the integration owner record the scope used for each request and avoid converting a missing score into a numeric zero. Do not expand query authority merely to conceal an unexamined empty result.\nVerification\nWith authorized read access, select a known finding and compare its CVE identifier with the tenant-scoped details result. Inspect the report’s behavior when enrichment is unavailable: the finding should remain visible with the uncertainty expressed. Review joins and any date or score filters so absent enrichment cannot silently remove findings from the intended report. Retain the request scopes and representative sanitized output as evidence of the data contract, without asserting that all tenant vulnerabilities were assessed.\nOfficial references\nMicrosoft Learn: Individual recommendation transition. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:26:22+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 238, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Transition from grouped to individual recommendations in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations" } } ] } }