🛡Shields up! Compare CISA Known Exploited Vulnerabilities Catalog to Microsoft Defender for Endpoint data. Use this KQL in DfE Advanced Hunting. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-overview

CISA_NEV_vs_DfE.kql

// make a table from https://www.cisa.gov/known-exploited-vulnerabilities-catalog
let CISA_NEV = (externaldata(CveId:string,vendorProject:string,product:string,vulnerabilityName:string,dateAdded:string,shortDescription:string,requiredAction:string,dueDate:datetime)
[@"https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv"] 
with (format="csv",ignoreFirstRecord=true));
let CISA_NEV_CveIDs= CISA_NEV | project CveId;  // make a list from CVEs column
DeviceTvmSoftwareVulnerabilities
| where  CveId in (CISA_NEV_CveIDs)  // compare DfE devices with CVEs to CISA NEV CVEs list 
| join kind = inner CISA_NEV on CveId  // Join table of CVEs on devices to CISA NEV table
// format results however you like. Below shows count of devices with each CISA NEV CVE, in due date order
| summarize count() by CveId,vendorProject,product,vulnerabilityName,MicrosoftRating=VulnerabilitySeverityLevel,MicrosoftRecommendedUpdate=RecommendedSecurityUpdate, dateAdded,shortDescription,requiredAction,dueDate
| order by dueDate asc