topic Re: Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time" in Cortex XDR Discussions

Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

Rinaldini_Cristian — Fri, 28 Jul 2023 08:52:07 GMT

Hi,

Is it possible to obtain a custom widget like "Vulnerabilities On All Endpoints Over Time" via XQL?

We would like to filter out some endpoint

Is there a dataset with detailed history information?

Thanks

Re: Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

PiyushKohli — Fri, 28 Jul 2023 09:40:09 GMT

Hi @Rinaldini_Cristian

Thank you for writing to live community!

Yes, you may create a custom widget using XQL. If you are having Host Insights license, then you may use the following datasets and update your XQL query with desired filters according to your use case/requirement.

1. dataset = va_cves (This dataset contains vulnerability data for applications)

2. dataset = va.endpoints (This dataset contains vulnerability data for endpoints)

Snippet for example/reference:

Reference: Datasets-and-Presets

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

Rinaldini_Cristian — Fri, 28 Jul 2023 12:38:46 GMT

Hi PiyushKohli,

thanks for your answer.

We have the Host Insights licence.

We already know these datasets and the way to build a custom widget using XQL.

Unfortunately I think that in these datasets there are only data related to last "scan" (day).

Therefore it would be not possible to show historical data like this:

Cristian

Re: Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

PiyushKohli — Tue, 01 Aug 2023 07:06:59 GMT

Hi @Rinaldini_Cristian

Yes, you are correct Host Insights dataset will only have data related to last "scan" (day). However, you may leverage correlation rule to execute XQL query for Host Insights dataset daily and store the result of the XQL query to "Save to dataset" as Action. Now you will have data related to scan for every day as correlation rule executes daily hence overcoming the limit of last "scan" (day) data and therefore now you may use this dataset to create your XQL widget.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

Re: Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

I.Wrage — Tue, 15 Oct 2024 17:02:34 GMT

Is there an update on this functionality?
The Built in Widget has the data from the previous month but we need to build and save additional datasets to utilize the same date?