[Aidan Abbott (atabbott)]

Summary

The Containers Security workbook can show blank versions, zero patchable packages and no exploitable vulnerabilities even when Defender for Cloud has the underlying data. Some CVE detail and overview queries also drop findings because they expand CVSS fields that are no longer present in the assessment.

This fixes two schema changes:

• Parse properties.additionalData.ScannersDetails and fall back to its MDVM detected/fixed versions when the top-level fields are empty. Existing top-level values retain precedence across the 37 affected queries.
• Join assessed CVE IDs to microsoft.security/cvedetails, following the 21 August 2026 CVE data change. The 24 queries that consume CVE metadata use the current tenant as their Resource Graph scope, with the selected subscriptions explicitly filtered on the assessment side. Existing resource filters are retained.

The metadata join is left outer. Public, verified and exploit-kit indicators now read the current catalogue fields; missing flags remain Unknown rather than becoming No. Summary tables distinguish unknown exploit status, missing catalogue records and incomplete exploit flags. Severity breakdowns retain an Unknown bucket instead of dropping CVEs without an assessment severity. The detail view labels assessment and catalogue severity separately and exposes EPSS probability/percentile plus versioned CVSS v2, v3 and v4 scores and vectors. Descriptions, publication dates and reference URLs come from the catalogue; CVEs remain visible when metadata or references are absent. CVE metadata update times are labelled separately from image scan times. Two overview queries no longer expand an unused inline CVSS array that could remove otherwise valid findings.

This changes how existing assessment data is displayed. It does not restore missing assessments or change the Defender for Cloud Recommendations page. Fix availability remains separate from exploit availability.

Validation

• git diff --check passed.
• npm test -- --grep 'Validating Workbooks' passed: 2 checks in a sparse checkout containing the changed workbook, not a full-repository test run.
• Live Azure Workbooks checks of the patched AWS summaries preserved the CVE totals and version-fallback results. The ECR query now identifies CVEs with positive public/verified exploit indicators, and the known-exploits table shows the affected packages.
• Checked the patched CVE detail query against live data: scores, vectors, descriptions, dates and reference URLs populated.
• Forced an empty metadata join in validation copies of the summary and detail queries. All assessed CVEs were retained and classified as unknown; absent CVSS and references did not remove rows.
• Live checks of ECR and EKS severity breakdowns retained the existing severity groups and exposed previously excluded Unknown severities. Validation copies with missing catalogue records, missing severity and incomplete exploit flags retained the assessed CVEs and reported the gaps separately.
• Live validation was limited to AWS. Azure and GCP use the same migration pattern but have not been tested against live Azure or GCP assessment data.

Screenshots and checklist

No screenshots attached because the live results contain private resource details. This updates the existing template; no new gallery entry, folder or CODEOWNERS change is needed. The layout and drill-down parameters are retained, with indicator labels adjusted to match the current metadata fields.

[Aidan Abbott (atabbott)]

@microsoft-github-policy-service agree