Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data

Source facts

In Defender for Cloud’s individual-recommendation schema, CvesDetails retains each vulnerability’s CveId. Additional information is available through the microsoft.security/cvedetails resource type. Microsoft requires tenant scope for that query: subscription scope returns no records from this type, so enrichment fields such as LatestPublishedDate, LastModifiedDate and CVSSScore are not returned there. Microsoft Learn.

Applicability

This concerns an Azure Resource Graph enrichment pipeline, not the meaning of a CVSS score or the priority of a particular vulnerability. A report may need to distinguish finding data from the separately retrieved CVE details.

DSE recommendation

Separate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly. Preserve the CVE identifier even when the enrichment stage supplies no matching details. Have the integration owner record the scope used for each request and avoid converting a missing score into a numeric zero. Do not expand query authority merely to conceal an unexamined empty result.

Verification

With authorized read access, select a known finding and compare its CVE identifier with the tenant-scoped details result. Inspect the report’s behavior when enrichment is unavailable: the finding should remain visible with the uncertainty expressed. Review joins and any date or score filters so absent enrichment cannot silently remove findings from the intended report. Retain the request scopes and representative sanitized output as evidence of the data contract, without asserting that all tenant vulnerabilities were assessed.

Official references

Microsoft Learn: Individual recommendation transition. Source reviewed September 9, 2026.