Answers: <p>I was able to achieve that</p>
  <pre><code>Update
  //|where OSType != &quot;Linux&quot; and UpdateState == &quot;Needed&quot; and Optional == &quot;false&quot;
  | where Classification in (&quot;Security Updates&quot;, &quot;Critical Updates&quot;) 
  | where PublishedDate &lt;= ago(30d)
  | where startofday(TimeGenerated) == startofday(now())
  | project TimeGenerated, Computer, Title, KBID, Classification, MSRCSeverity, PublishedDate, _ResourceId
  | sort by TimeGenerated desc
  | summarize any(KBID) by KBID, Title, Computer
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-08-17T17:52:58.713Z
Answers: 2022-08-17T17:52:58.713Z
Answers: SandeshR
Body: <p>Is there a KQL query to get a list of VMs which are not patched since last month. Below is the sample I have</p>
  <pre><code>Update
  | where Classification in (&quot;Security Updates&quot;, &quot;Critical Updates&quot;)
  | where UpdateState == 'Needed' and Optional == false and Approved == true
  | summarize count() by Classification, Computer, _ResourceId
  // This query requires the Security or Update solutions
  </code></pre>
  <p>How to apply the filter to just show the ones which are due since one month</p>
  
Tags: <azure><vm>
Title: Azure KQL query to display list of VMs which were not patch for since 1 months
UserDisplayName: SandeshR
ThreadText: # Azure KQL query to display list of VMs which were not patch for since 1 months
  
  (Asked by: username_0 on 2022-08-17)
  
  Is there a KQL query to get a list of VMs which are not patched since last month. Below is the sample I have
  
  ```
  Update
  | where Classification in ("Security Updates", "Critical Updates")
  | where UpdateState == 'Needed' and Optional == false and Approved == true
  | summarize count() by Classification, Computer, _ResourceId
  // This query requires the Security or Update solutions
  
  ```
  
  How to apply the filter to just show the ones which are due since one month
  
  **Tags:** azure, vm
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-08-17. Score: 0 | Accepted answer
  
  I was able to achieve that
  
  ```
  Update
  //|where OSType != "Linux" and UpdateState == "Needed" and Optional == "false"
  | where Classification in ("Security Updates", "Critical Updates") 
  | where PublishedDate <= ago(30d)
  | where startofday(TimeGenerated) == startofday(now())
  | project TimeGenerated, Computer, Title, KBID, Classification, MSRCSeverity, PublishedDate, _ResourceId
  | sort by TimeGenerated desc
  | summarize any(KBID) by KBID, Title, Computer
  
  ```
  
  
  ---
  
  