Query: All vulnerabilities under 29 days

DavidMoalem1 — Wed, 05 Feb 2025 21:12:48 GMT

I created this query to identify all vulnerabilities under 29 days:

dataset = va_cves
| alter days = timestamp_diff(current_time(),publication_date ,"DAY")
| filter days > 0 and days < 30
|arrayexpand affected_hosts

Is there a way to tie in IP Addresses from a different dataset (e.g. dataset = endpoints) and match them to the computer names within the endpoint_name field?

Re: Query: All vulnerabilities under 29 days

jmazzeo — Fri, 07 Feb 2025 12:40:14 GMT

Hi @DavidMoalem1, thanks for reaching us using the Live Community.

You can try this XQL query:

dataset = va_cves | alter days = timestamp_diff(current_time(),publication_date ,"DAY") | filter days > 0 and days < 30 |arrayexpand affected_hosts | join (dataset = endpoints | fields endpoint_name as Hostname, ip_address as IP) as endpoints endpoints.Hostname = affected_hosts | fields Hostname, IP, name, affected_products, severity_score, os_type, description, severity

You can add the required fields as you need.

If this post answers your question, please mark it as the solution.

topic Re: Query: All vulnerabilities under 29 days in Cortex XDR Discussions

Query: All vulnerabilities under 29 days

Re: Query: All vulnerabilities under 29 days