# Example: Vulnerability & Exposure Management Report

**Status:** HIGH RISK — Exploitable CVEs and end-of-support software on critical assets
**Investigation Type:** Vulnerability & Exposure Management (Org-Wide)
**Date:** February 2026
**Generated by:** GitHub Copilot in Agent mode with Claude Opus 4.6
**Classification:** Example Investigation (PII Scrubbed)

---

## About This Example

This is a sanitized copy of an actual vulnerability & exposure management report generated by the `exposure-investigation` skill. All personally identifiable information (device names, workspace details) has been replaced with generic placeholders. The structure, risk scoring methodology, and analysis patterns are preserved to demonstrate the investigation workflow.

---

# Vulnerability & Exposure Management Report

**Generated:** 2026-02-12  
**Scope:** Org-Wide  
**Overall Risk Rating:** 🟠 **High**  
**Data Source:** Microsoft Defender XDR Advanced Hunting (DeviceTvm*, ExposureGraph*)  
**Devices in Scope:** 8 active + 1 inactive

---

## 1. Executive Summary

### Overall Risk: 🟠 High

**Evidence:**
- 🟠 8 CVEs with known exploits (highest CVSS 8.8) — active threat to 4 devices
- 🟠 End-of-support software on critical assets: Windows Server 2012 R2 (EoS Oct 2023), OpenSSL 1.1.1 (EoS Sep 2023) on 5 devices
- 🟡 Overall configuration compliance rate: 67% (below 75% threshold)
- 🟢 No internet-facing critical assets with vulnerabilities
- ✅ No multi-hop attack paths from RCE-vulnerable devices to critical servers
- 🟢 Defender health: All active Windows devices pass all critical controls at 100%

### Key Metrics

| Metric | Value |
|--------|-------|
| Total CVEs | 446 |
| Critical CVEs | 21 |
| Exploitable CVEs (known exploits) | 8 |
| Devices with vulnerabilities | 8 |
| Overall compliance rate | 67.0% |
| High-impact misconfigurations (Impact ≥ 8) | 20 |
| End-of-support software items | 11 |
| Expired certificates | 33 |
| Critical assets (Exposure Management) | 7 |
| Attack paths detected | 0 |

### 🎯 Top 3 Priority Remediation Actions

1. 🔴 **Patch exploitable CVEs immediately** — Apply February 2026 security updates for CVE-2026-21510, CVE-2026-21513, CVE-2026-21533, CVE-2026-21519, CVE-2026-21514 on contoso-admin, contoso-vm, contoso-util, contoso-vd-0
2. 🟠 **Retire/upgrade end-of-support software** — Decommission Windows Server 2012 R2 (contoso-2012r2), upgrade OpenSSL 1.1.1 to 3.x across 5 devices, remove .NET Core 2.0 SDK
3. 🟠 **Harden security configurations** — Enable LSA protection, disable NTLM authentication, disable WinRM basic auth, deploy BitLocker encryption, enable ASR rules across 6 non-compliant servers

---

## 2. CVE Vulnerability Assessment

### 2a. Severity Distribution

| Severity | CVE Count | Devices Affected |
|----------|-----------|------------------|
| 🔴 Critical | 21 | 7 |
| 🟠 High | 127 | 8 |
| 🟡 Medium | 119 | 8 |
| 🔵 Low | 179 | 8 |
| **Total** | **446** | **8** |

### 2b. Exploitable Vulnerabilities (Known Exploits)

⚠️ **8 CVEs with confirmed known exploits — Priority 1 remediation required**

| CVE ID | CVSS | Severity | Description | Affected Devices |
|--------|------|----------|-------------|------------------|
| CVE-2026-21510 | 8.8 | 🟠 High | Windows Shell security feature bypass — allows network-based attackers to bypass protection mechanisms | contoso-admin, contoso-vm |
| CVE-2026-21513 | 8.8 | 🟠 High | MSHTML Framework security feature bypass — protection mechanism failure enables unauthorized network access | contoso-admin, contoso-vm |
| CVE-2025-48384 | 8.0 | 🟠 High | Git multiple vulnerabilities — trailing CR handling, bundle validation, and arbitrary code execution via malicious repos | contoso-util |
| CVE-2026-21514 | 7.8 | 🟠 High | Microsoft Office Word security bypass — untrusted input enables local security feature bypass | contoso-util, contoso-vm |
| CVE-2026-21533 | 7.8 | 🟠 High | Windows Remote Desktop privilege escalation — improper privilege management allows local elevation | contoso-admin, contoso-vm |
| CVE-2026-21519 | 7.8 | 🟠 High | Desktop Window Manager type confusion — enables local privilege escalation | contoso-admin, contoso-vm |
| CVE-2026-21525 | 6.2 | 🟡 Medium | Windows Remote Access Connection Manager DoS — null pointer dereference enables local denial of service | contoso-admin, contoso-vm |
| CVE-2026-20805 | 5.5 | 🟡 Medium | Desktop Window Manager information disclosure — sensitive data exposure via local access | contoso-vm |

### 2c. Top Vulnerable Software

| Vendor | Software | Critical | High | Total CVEs | Devices |
|--------|----------|----------|------|-----------|---------|
| openssl | openssl | 21 | 19 | 288 | 7 |
| microsoft | windows_11 | 0 | 77 | 108 | 1 |
| microsoft | windows_server_2019 | 0 | 17 | 20 | 1 |
| microsoft | office | 0 | 6 | 10 | 2 |
| microsoft | .net_core | 0 | 3 | 6 | 1 |
| microsoft | edge_chromium-based | 0 | 2 | 3 | 1 |
| php | php | 0 | 1 | 6 | 1 |
| microsoft | teams | 0 | 1 | 1 | 1 |
| git-scm | git | 0 | 1 | 1 | 1 |
| python | python | 0 | 0 | 2 | 1 |
| 7-zip | 7-zip | 0 | 0 | 1 | 1 |

> 🔴 **OpenSSL dominates the vulnerability landscape** — 288 CVEs (21 Critical) across 7 devices. This is driven primarily by the end-of-support OpenSSL 1.1.1 installation on 5 devices.

### 2d. Per-Device Vulnerability Matrix

| Device | OS | Critical | High | Medium | Low | Total |
|--------|-----|----------|------|--------|-----|-------|
| contoso-vm | Windows11 | 0 | 82 | 33 | 1 | **116** |
| contoso-vd-0 | Windows11 | 6 | 5 | 19 | 51 | **81** |
| contoso-util | WindowsServer2019 | 5 | 10 | 22 | 41 | **78** |
| contoso-admin | WindowsServer2019 | 2 | 22 | 13 | 18 | **55** |
| contoso-dc2 | WindowsServer2019 | 2 | 2 | 8 | 17 | **29** |
| contoso-sccm | WindowsServer2019 | 2 | 2 | 8 | 17 | **29** |
| contoso-dc1 | WindowsServer2019 | 2 | 2 | 8 | 17 | **29** |
| contoso-2012r2 | WindowsServer2012R2 | 2 | 2 | 8 | 17 | **29** |

> ⚠️ **contoso-vm** has the highest total count (116 CVEs, 82 High) — likely due to Windows 11 + Office suite combined attack surface. **contoso-vd-0** has the most Critical CVEs (6).

---

## 3. Security Configuration Compliance

### 3a. Compliance by Category

| Category | Total Assessments | Compliant | Non-Compliant | Not Applicable | Compliance Rate |
|----------|-------------------|-----------|--------------|----------------|-----------------|
| Application | 147 | 9 | 3 | 135 | 75.0% |
| Security Controls | 490 | 234 | 33 | 223 | 🟡 87.6% |
| Accounts | 94 | 39 | 22 | 33 | 🟠 63.9% |
| OS | 252 | 84 | 76 | 92 | 🟠 52.5% |
| Network | 147 | 40 | 66 | 41 | 🔴 37.7% |
| **Overall** | **1,130** | **406** | **200** | **524** | **67.0%** |

> 🔴 **Network compliance is critically low at 37.7%** — primarily due to NTLM authentication, LAN Manager authentication level, and firewall configuration gaps across all 6 Windows servers.

### 3b. Per-Device Compliance Scorecard

| Device | Total Checks | Compliant | Non-Compliant | N/A | Compliance Rate |
|--------|-------------|-----------|--------------|-----|-----------------|
| contoso-2012r2 | 156 | 52 | 32 | 72 | 🟠 61.9% |
| contoso-sccm | 163 | 66 | 33 | 64 | 🟡 66.7% |
| contoso-vd-0 | 163 | 76 | 38 | 49 | 🟡 66.7% |
| contoso-util | 163 | 69 | 33 | 61 | 🟡 67.6% |
| contoso-dc1 | 161 | 67 | 32 | 62 | 🟡 67.7% |
| contoso-dc2 | 161 | 68 | 31 | 62 | 🟡 68.7% |
| CONTOSO-LINUX | 163 | 8 | 1 | 154 | 🟢 88.9% |

> ⚠️ **contoso-2012r2** has the worst compliance rate (61.9%), consistent with its EoS status. Domain controllers contoso-dc1/dc2 are at ~68%.

### 3c. High-Impact Misconfigurations (Impact ≥ 8)

**20 misconfigurations with Impact 8-9 identified across the fleet.**

#### Impact 9 — Critical (6 findings)

**1. Block use of copied or impersonated system tools (ASR)**
- **Category:** Security Controls > Attack Surface Reduction
- **Impact Score:** 9/10
- **Risk:** Malicious programs may copy or impersonate Windows system tools to avoid detection or gain privileges
- **Affected Devices:** 6 — contoso-dc1, contoso-dc2, contoso-vd-0, contoso-util, contoso-2012r2, contoso-sccm
- **Remediation:** Enable ASR rule in Block mode via Intune or Group Policy. Requires MDE Antivirus primary + RTP enabled.

**2. Secure Microsoft Defender Firewall domain profile**
- **Category:** Security Controls > Firewall
- **Impact Score:** 9/10
- **Risk:** Firewall off = all traffic can access the system, enabling remote exploitation
- **Affected Devices:** 6 — contoso-dc1, contoso-dc2, contoso-vd-0, contoso-util, contoso-2012r2, contoso-sccm
- **Remediation:** Enable Defender Firewall on domain profile with inbound connections blocked. Deploy via Intune Endpoint Security > Firewall policy.

**3. Block rebooting machine in Safe Mode (ASR)**
- **Category:** Security Controls > Attack Surface Reduction
- **Impact Score:** 9/10
- **Risk:** Attackers reboot to Safe Mode where security products are disabled/limited, enabling tampering and encryption
- **Affected Devices:** 6 — contoso-dc1, contoso-dc2, contoso-vd-0, contoso-util, contoso-2012r2, contoso-sccm
- **Remediation:** Enable ASR rule in Block mode. Requires MDE Antivirus primary + RTP enabled.

**4. Encrypt all BitLocker-supported drives**
- **Category:** Security Controls > BitLocker
- **Impact Score:** 9/10
- **Risk:** Unencrypted drives are exposed to unauthorized access and data tampering while offline
- **Affected Devices:** 5 — contoso-dc1, contoso-dc2, contoso-vd-0, contoso-util, contoso-sccm
- **Remediation:** Deploy BitLocker encryption. See [BitLocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview).

**5. PUA protection in block mode for Linux**
- **Category:** Security Controls > Antivirus
- **Impact Score:** 9/10
- **Risk:** Without PUA in Block mode, machines vulnerable to unwanted applications with potentially malicious behavior
- **Affected Devices:** 1 — CONTOSO-LINUX
- **Remediation:** Enable PUA protection in Block mode via MDE for Linux configuration.

**6. Block abuse of exploited vulnerable signed drivers (ASR)**
- **Category:** Security Controls > Attack Surface Reduction
- **Impact Score:** 9/10
- **Risk:** Vulnerable signed drivers exploited by local apps for kernel-level access, disabling security solutions
- **Affected Devices:** 1 — contoso-2012r2
- **Remediation:** Enable ASR rule in Block mode.

#### Impact 8 — High (14 findings)

| # | Configuration | Category | Risk | Affected |
|---|--------------|----------|------|----------|
| 7 | Disable anonymous enumeration of shares | OS | Network resource mapping for attackers | 6 devices |
| 8 | Disable admin accounts enumeration on elevation | OS | Exposes logon information to unauthorized users | 6 devices |
| 9 | Disable NTLM authentication | Network | Credential theft and lateral movement via NTLM relay | 6 devices |
| 10 | Set UAC to auto-deny elevation requests | OS | Prevents credential caching with standard profiles | 6 devices |
| 11 | Disable Autoplay for all drives | OS | Malicious auto-execution from removable media | 6 devices |
| 12 | Set AutoRun to "Do not execute" | OS | Prevents autorun command execution | 6 devices |
| 13 | Set LAN Manager to NTLMv2 only, refuse LM & NTLM | Network | Weak auth protocols enable password sniffing | 6 devices |
| 14 | Disable Solicited Remote Assistance | OS | Unauthorized remote access to resources | 6 devices |
| 15 | Disable Remote Registry Service | OS | Registry-based credential theft, lateral movement, persistence | 5 devices |
| 16 | Disable WinRM Basic auth (Service) | OS | Plain text passwords exposed in transit | 5 devices |
| 17 | Disable WinRM Basic auth (Client) | OS | Plain text passwords exposed in transit | 5 devices |
| 18 | Enable LSA protection (RunAsPPL) | OS | Pass-the-Hash attacks on unprotected LSA | 5 devices |
| 19 | Disable built-in Administrator account | Accounts | Well-known SID enables brute force / SID-based auth | 4 devices |
| 20 | SMB server security hardening | Application | Authentication relay attacks via unsigned/unencrypted SMB | 3 devices |

---

## 4. End-of-Support Software

⚠️ **11 EoS software items detected — no patches available for these versions**

| Vendor | Software | Version | EoS Status | EoS Date | Affected Devices |
|--------|----------|---------|------------|----------|------------------|
| microsoft | visual_c++ | 12.0.40660.0 | 🔴 EOS Version | 2024-04-09 | 5 (dc2, sccm, dc1, 2012r2, util) |
| openssl | openssl | 1.1.1.0 | 🔴 EOS Version | 2023-09-11 | 5 (dc2, sccm, dc1, vd-0, util) |
| microsoft | visual_c++ | 12.0.21005.1 | 🔴 EOS Version | 2024-04-09 | 2 (sccm, dc1) |
| microsoft | windows_server_2012_r2 | 6.3.9600.23022 | 🔴 EOS Software | 2023-10-10 | 1 (contoso-2012r2) |
| openssl | openssl | 3.2.3.0 | 🔴 EOS Version | 2025-11-23 | 1 (util) |
| microsoft | .net_core_sdk | 2.0.0.0 | 🔴 EOS Version | 2018-10-01 | 1 (contoso-admin) |
| microsoft | .net_core | 2.0.0.0 | 🔴 EOS Version | 2018-10-01 | 1 (contoso-admin) |
| microsoft | visual_c++ | 9.0.30729.6161 | 🔴 EOS Version | 2024-04-09 | 1 (util) |
| microsoft | visual_c++ | 12.0.30501.0 | 🔴 EOS Version | 2024-04-09 | 1 (util) |
| microsoft | visual_c++ | 9.0.21022.0 | 🔴 EOS Version | 2024-04-09 | 1 (util) |
| openssl | openssl | 3.3.3.0 | 🟡 Upcoming EOS | 2026-04-09 | 1 (vd-0) |

> 🔴 **Highest risk:** Windows Server 2012 R2 (contoso-2012r2) has been EoS since October 2023 and is classified as Criticality Level 1 in Exposure Management. OpenSSL 1.1.1 (EoS Sep 2023) is the primary driver of the 21 Critical CVEs in the fleet.

---

## 5. Exposure Management

### 5a. Critical Asset Inventory

| Device | Criticality Level | Internet-Facing | Vulnerable to RCE | Vulnerable to PrivEsc | Type |
|--------|------------------|-----------------|--------------------|-----------------------|------|
| contoso-dc1 | **0** (Most Critical) | 🟢 No | 🟢 No | 🟢 No | Azure VM (Domain Controller) |
| contoso-dc2 | **0** (Most Critical) | 🟢 No | 🟢 No | 🟢 No | Azure VM (Domain Controller) |
| contoso-vd-0 | **1** (High Priority) | 🟢 No | 🟢 No | 🟢 No | Azure VM |
| contoso-sccm | **1** (High Priority) | 🟢 No | 🟢 No | 🟢 No | Azure VM |
| contoso-util | **1** (High Priority) | 🟢 No | 🟢 No | 🟢 No | Azure VM |
| contoso-2012r2 | **1** (High Priority) | 🟢 No | 🟢 No | 🟢 No | Azure VM |
| contoso-admin | **1** (High Priority) | 🟢 No | 🟢 No | 🟢 No | Azure VM |

> 🟢 **Positive finding:** No critical assets are internet-facing, and none are currently flagged as vulnerable to RCE or privilege escalation in the Exposure Graph.

### 5b. Internet-Facing Critical Assets with Vulnerabilities

✅ No internet-facing critical assets with vulnerabilities detected.

### 5c. Attack Path Analysis

✅ No multi-hop attack paths from RCE-vulnerable devices to critical servers detected.

This means there are no exploitable chains of: Vulnerable Device → Compromised Identity → Lateral Movement to Critical Server.

---

## 6. Endpoint Health

### 6a. Defender Device Health

#### Fleet Summary — Active Devices

| Control | Windows11 | WindowsServer2019 | WindowsServer2012R2 | Linux |
|---------|-----------|-------------------|---------------------|-------|
| AVMode | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | — |
| AVSignatures | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | 🟢 100% (1/1) |
| RealtimeProtection | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | 🟢 100% (1/1) |
| TamperProtection | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | — |
| CloudProtection | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | 🟢 100% (1/1) |
| BehaviourMonitoring | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | — |
| PUAProtection | 🟢 100% (1/1) | 🟢 100% (5/5) | 🟢 100% (1/1) | 🔴 **0% (0/1)** |
| CoreComponentsUpdate | — | — | 🟢 100% (1/1) | 🟢 100% (1/1) |

> 🟢 **All active Windows devices (8 across Win11, WS2019, WS2012R2) pass all Defender health controls at 100%.**

#### Inactive Device Summary

| Control | Windows11 |
|---------|-----------|
| All controls | 🟢 100% (1/1) |

🔵 1 inactive Windows 11 device — all controls compliant at last check. Verify if device should be decommissioned or reconnected.

#### Non-Compliant Exceptions (Active Devices Only)

| Device | OS | Failed Controls | Count | Highest Impact |
|--------|-----|-----------------|-------|----------------|
| CONTOSO-LINUX | Linux | PUAProtection | 1 | 9.0 |

> ⚠️ CONTOSO-LINUX is the only active device with a Defender health compliance exception. All other active devices pass all controls.

### 6b. Certificate Status

| Device | Status | Count |
|--------|--------|-------|
| contoso-admin | 🔴 Expired | 33 |
| contoso-admin | 🟡 Expiring within 30 days | 4 |

> 🔴 **contoso-admin has 33 expired certificates and 4 expiring within 30 days.** Review and renew critical certificates to prevent service outages.

---

## 7. Prioritized Remediation Plan

| Priority | Category | Action | Impact | Affected |
|----------|----------|--------|--------|----------|
| 🔴 Immediate | **CVE Patching** | Apply February 2026 security updates — CVE-2026-21510, CVE-2026-21513 (CVSS 8.8), CVE-2026-21533, CVE-2026-21519, CVE-2026-21514 (CVSS 7.8) | Eliminates 8 exploitable CVEs with known exploits | contoso-admin, contoso-vm, contoso-util, contoso-vd-0 |
| 🔴 Immediate | **Certificate Renewal** | Renew 33 expired + 4 expiring certificates on contoso-admin | Prevents service outages and security gaps | contoso-admin |
| 🟠 Short-term | **EoS Retirement** | Decommission Windows Server 2012 R2 (contoso-2012r2) — EoS Oct 2023, no security patches available | Eliminates unpatched attack surface on Criticality Level 1 asset | contoso-2012r2 |
| 🟠 Short-term | **OpenSSL Upgrade** | Upgrade OpenSSL 1.1.1 → 3.x across 5 devices | Resolves 21 Critical + 19 High CVEs (288 total) | dc1, dc2, sccm, vd-0, util |
| 🟠 Short-term | **LSA Protection** | Enable RunAsPPL on 5 servers to protect against Pass-the-Hash attacks | Impact 8/10 — prevents credential theft | dc1, dc2, util, 2012r2, sccm |
| 🟠 Short-term | **NTLM Hardening** | Disable NTLM authentication, set LAN Manager to NTLMv2 only | Impact 8/10 — prevents credential relay attacks | All 6 Windows servers |
| 🟠 Short-term | **Firewall Hardening** | Enable Defender Firewall on domain profile, block inbound connections | Impact 9/10 — prevents direct network exploitation | All 6 Windows servers |
| 🟡 Medium-term | **ASR Rules** | Enable Block mode for: copied system tools, Safe Mode reboot, vulnerable signed drivers | Impact 9/10 — prevents malware defense evasion | 6 devices (1 for signed drivers) |
| 🟡 Medium-term | **BitLocker** | Deploy full-volume encryption on 5 servers | Impact 9/10 — protects data at rest | dc1, dc2, vd-0, util, sccm |
| 🟡 Medium-term | **WinRM & Remote Services** | Disable WinRM basic auth (client+service), disable Remote Registry, disable Solicited Remote Assistance | Impact 8/10 — reduces remote attack surface | 5–6 devices |
| 🟡 Medium-term | **Account Hardening** | Disable built-in Administrator account, disable admin enumeration on elevation, disable anonymous share enumeration | Impact 8/10 — reduces credential attack surface | 4–6 devices |
| 🟡 Medium-term | **SMB Hardening** | Enable SMB signing, EPA/SPN validation, and encryption | Impact 8/10 — prevents authentication relay attacks | 3 devices |
| 🟡 Medium-term | **Linux PUA** | Enable PUA protection in Block mode on CONTOSO-LINUX | Impact 9/10 — blocks unwanted applications | CONTOSO-LINUX |
| 🟢 Ongoing | **EoS Software Cleanup** | Remove Visual C++ EoS redistributables (2013, 2008), .NET Core 2.0 SDK, OpenSSL 3.2.3 | Reduces attack surface from unsupported components | Multiple devices |
| 🟢 Ongoing | **Upcoming EoS Monitoring** | OpenSSL 3.3.3 reaches EoS on 2026-04-09 — plan upgrade before deadline | Prevents future unpatched state | contoso-vd-0 |

---

## 8. Appendix

### Data Freshness
- **DeviceTvm* tables:** Assessment data refreshes periodically (typically every 12-24 hours)
- **ExposureGraph tables:** Snapshot data (no timestamp filter applied)
- **Report generated:** 2026-02-12 from Advanced Hunting queries

### KQL Queries Used

| # | Description | Table(s) |
|---|-------------|----------|
| Q1 | CVE severity distribution | DeviceTvmSoftwareVulnerabilities |
| Q2 | Exploitable CVEs with known exploits | DeviceTvmSoftwareVulnerabilities + DeviceTvmSoftwareVulnerabilitiesKB |
| Q3 | Security config compliance by category | DeviceTvmSecureConfigurationAssessment |
| Q4 | End-of-support software inventory | DeviceTvmSoftwareInventory |
| Q5 | Per-device vulnerability counts | DeviceTvmSoftwareVulnerabilities |
| Q6 | Per-device compliance scorecard | DeviceTvmSecureConfigurationAssessment |
| Q7 | Critical asset inventory | ExposureGraphNodes |
| Q8 | High-impact misconfigurations with remediation | DeviceTvmSecureConfigurationAssessment + KB |
| Q9 | Defender health fleet summary | DeviceTvmSecureConfigurationAssessment + DeviceInfo |
| Q10 | Attack path summary | ExposureGraphEdges + ExposureGraphNodes |
| Q11 | Defender health non-compliant exceptions | DeviceTvmSecureConfigurationAssessment + DeviceInfo |
| Q13 | Certificate expiration status | DeviceTvmCertificateInfo + DeviceInfo |
| Q14 | Top vulnerable software by CVE count | DeviceTvmSoftwareVulnerabilities |
| Q15 | Internet-facing critical assets | ExposureGraphNodes |

### Methodology
- All queries executed via `RunAdvancedHuntingQuery` (Microsoft Defender XDR Advanced Hunting API)
- Risk rating based on: exploitable CVEs, compliance rates, EoS software, active attack paths, internet-facing exposure
- Defender health scoring uses SCID-based assessment with active/inactive device classification (7-day threshold)
- Configuration impact scores sourced from `DeviceTvmSecureConfigurationAssessmentKB`
