topic Re: How to query for Vulnerability Assessment Data in Cortex XDR Discussions

How to query for Vulnerability Assessment Data

JamesWiggins — Fri, 01 Jul 2022 13:22:58 GMT

I would like to query XDR externally for the data stored in the Host Insights > Vulnerability Assessment page.

I looked through all of the available APIs, but none of them seem to have data related to CVEs. I would not be opposed to writing a custom XQL query for this data, but I do not see fields related to CVE's in the xdr_data schema either.. is it in there somewhere and I just missed it?

I know I can manually export the data to file on the page, but I need to accomplish this programmatically.

Any tips on how I could go about extracting this data?

Re: How to query for Vulnerability Assessment Data

SilviuMihailDascalu — Fri, 01 Jul 2022 18:27:26 GMT

Hi @JamesWiggins ,

Thanks for posting to our Live Community discussion board. At the moment information about CVE is only available inside the UI (via export function). As an alternative you can create a custom dataset containing the vulnerabilities in the CSV format and be able to map it against other datasets.

Let me know if you got any questions or concerns!

Thanks,

Silviu

Thanks,

Silviu

Re: How to query for Vulnerability Assessment Data

JamesWiggins — Fri, 01 Jul 2022 19:46:12 GMT

Thanks for the reply! Can you elaborate on what you mean by "create a custom dataset"?

Are you talking about just using the export function to create a CSV?

Re: How to query for Vulnerability Assessment Data

Cyber1985 — Sun, 06 Nov 2022 12:30:51 GMT

I think he means you can upload it as a lookup.

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/dtrh-finding-new-xql-fields-and-joining-data/m-p/399033#M666

Rob