Missing CVENumbers and PackageSeverity Details in Kusto Query Result

Question

Update
| where TimeGenerated > ago(5h) and OSType == "Linux" and SourceComputerId in ((Heartbeat
    | where TimeGenerated > ago(12h) and OSType == "Linux" and notempty(Computer)
    | summarize arg_max(TimeGenerated, Solutions) by SourceComputerId
    | where Solutions has "updates"
    | distinct SourceComputerId))
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by Computer, SourceComputerId, Product, ProductArch
| where UpdateState =~ "Needed" and Computer == "AM-PROD-APP1"
| render table

The query provided above does not include the details of CVENumbers and PackageSeverity in its result. I am looking for a solution to include these details in the query result

Answer 1

Hi HurminLNU-FT,

Thank you for posting query in Microsoft Q&A Platform.

To include columns we need to include then in summarize operator. Kindly try to include missing columns to it if that works as per your requirement.

Below is the sample query just for reference.

Update
| where TimeGenerated > ago(5h) and OSType == "Linux" and SourceComputerId in ((Heartbeat
    | where TimeGenerated > ago(12h) and OSType == "Linux" and notempty(Computer)
    | summarize arg_max(TimeGenerated, Solutions) by SourceComputerId
    | where Solutions has "updates"
    | distinct SourceComputerId))
| summarize hint.strategy=partitioned arg_max(TimeGenerated, *) by Computer, SourceComputerId, Product, ProductArch, CVENumbers, PackageSeverity
| where UpdateState =~ "Needed" and Computer == "AM-PROD-APP1"
| render table

Hope this helps. Please try and let me know how it goes. Thank you.