Defender CVE Details Missing in ARG? Fix the New Resource Join

An Azure Resource Graph query for Microsoft Defender for Cloud completes successfully and returns CVE identifiers, but CVSS scores, descriptions, and other extended CVE properties are missing. This silent data-quality failure can produce incomplete vulnerability exports without generating a query error. Microsoft changed how detailed CVE information is consumed in Azure Resource Graph. The assessment `CvesDetails` collection continues to provide `CveId`, while extended properties now come from the dedicated `microsoft.security/cvedetails` resource type. Existing queries and automations that assume all details remain embedded in assessment records must be updated. This realistic walkthrough shows the broken export, verifies that Defender vulnerability scanning is healthy, extracts assessment-side CVE identifiers, queries the new resource type, joins both branches on `CveId`, validates field and row coverage, and replaces the legacy query with monitoring against future silent failures. This demonstration uses fictional, sanitized lab data. Resources, CVE identifiers, findings, recommendations, query output, exports, and change records shown in the video are not production data. What you will learn: Why a successful ARG query can still return incomplete CVE data What Microsoft changed on August 21, 2026 How to distinguish an export problem from a scanner problem How to parse and expand assessment-side `CvesDetails` How to query `microsoft.security/cvedetails` How to join assessment context to extended CVE properties Why empty identifiers should be removed before joining How to compare source, matched, and unmatched CVE keys How to validate required fields and unexpected duplicates How to monitor future schema or coverage regressions Chapters: 00:00 Show the broken CVE export 00:39 Confirm Microsoft's CVE data-model change 01:15 Verify vulnerability scanning is healthy 01:55 Extract assessment-side CVE identifiers 02:34 Query microsoft.security/cvedetails 03:08 Join assessments to extended CVE records 03:43 Validate schema and row coverage 04:17 Replace the legacy query and add monitoring Official Microsoft references: Defender for Cloud release notes: https://learn.microsoft.com/en-us/azu... Machine vulnerability export and current ARG query: https://learn.microsoft.com/en-us/azu... #InfraPulse #MicrosoftDefender #DefenderForCloud #AzureResourceGraph #KQL #CVE #VulnerabilityManagement #AzureSecurity #SysAdmin #CloudSecurity