topic Re: Cortex host insight Vulnerability Assessment average severity score in Cortex XDR Discussions

Cortex host insight Vulnerability Assessment average severity score

TCoffey2 — Wed, 26 Feb 2025 01:00:28 GMT

trying to find XQL query that will take all of our severity scores and give us a average and send that to report. I cant seem find the dataset

Not very good with XQL at this time. maybe someone from the community can help

dataset = host_inventory
| filter 0 is not null and array_length(vulnerabilities) > 0
| alter vulnerability_scores = array_map(vulnerabilities, vulnerability -> case(
vulnerability.severity == "Critical", 10,
vulnerability.severity == "High", 7,
vulnerability.severity == "Medium", 5,
vulnerability.severity == "Low", 2,
vulnerability.cvss_score, vulnerability.cvss_score,
0 // Default if severity is unknown
))
| alter average_severity_score = array_avg(vulnerability_scores)
| fields host_name, average_severity_score, timestamp
| sort timestamp desc

Re: Cortex host insight Vulnerability Assessment average severity score

mavega — Wed, 26 Feb 2025 18:55:51 GMT

Hi,

Thanks for joining Live Community.

You can try using the va_endpoint and va_cves datasets, and then filter as you need.

Example below short query:

|dataset = va_endpoints
| fields cves, endpoint_name, os_type, severity

If you need information on XQL, you can review below:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-with-XQL

https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction

LIVEcommunity - Cortex XDR Basic XQL Crash Course - LIVEcommunity - 544056

LIVEcommunity - Cortex XDR XQL Use Cases and Applications Crash Course - LIVEcommunity - 544228

If this post solves your inquiry, please mark As Solution.

Re: Cortex host insight Vulnerability Assessment average severity score

aspatil — Thu, 27 Feb 2025 06:05:14 GMT

Hello,

Below query gives you the average by Endpoint name

dataset = va_endpoints
| filter cves != null
| fields cves , endpoint_name , severity , severity_score
| comp avg(severity_score) as Average_Severity_Score by endpoint_name

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.