<p>I was able to achieve that</p>
<pre><code>Update
//|where OSType != &quot;Linux&quot; and UpdateState == &quot;Needed&quot; and Optional == &quot;false&quot;
| where Classification in (&quot;Security Updates&quot;, &quot;Critical Updates&quot;) 
| where PublishedDate &lt;= ago(30d)
| where startofday(TimeGenerated) == startofday(now())
| project TimeGenerated, Computer, Title, KBID, Classification, MSRCSeverity, PublishedDate, _ResourceId
| sort by TimeGenerated desc
| summarize any(KBID) by KBID, Title, Computer
</code></pre>

CC BY-SA 4.0
2022-08-17T17:52:58.713Z
2022-08-17T17:52:58.713Z
SandeshR
<p>Is there a KQL query to get a list of VMs which are not patched since last month. Below is the sample I have</p>
<pre><code>Update
| where Classification in (&quot;Security Updates&quot;, &quot;Critical Updates&quot;)
| where UpdateState == 'Needed' and Optional == false and Approved == true
| summarize count() by Classification, Computer, _ResourceId
// This query requires the Security or Update solutions
</code></pre>
<p>How to apply the filter to just show the ones which are due since one month</p>

<azure><vm>
Azure KQL query to display list of VMs which were not patch for since 1 months
SandeshR
# Azure KQL query to display list of VMs which were not patch for since 1 months

(Asked by: username_0 on 2022-08-17)

Is there a KQL query to get a list of VMs which are not patched since last month. Below is the sample I have
Update
| where Classification in ("Security Updates", "Critical Updates")
| where UpdateState == 'Needed' and Optional == false and Approved == true
| summarize count() by Classification, Computer, _ResourceId
// This query requires the Security or Update solutions

How to apply the filter to just show the ones which are due since one month

**Tags:** azure, vm


---

## 1 answers

### Answer by username_0 on 2022-08-17. Score: 0 | Accepted answer

I was able to achieve that
Update
//|where OSType != "Linux" and UpdateState == "Needed" and Optional == "false"
| where Classification in ("Security Updates", "Critical Updates") 
| where PublishedDate <= ago(30d)
| where startofday(TimeGenerated) == startofday(now())
| project TimeGenerated, Computer, Title, KBID, Classification, MSRCSeverity, PublishedDate, _ResourceId
| sort by TimeGenerated desc
| summarize any(KBID) by KBID, Title, Computer


---

