Vulnerabilities Over Time Dashboard - Cortex

3SCMAN — Mon, 31 Mar 2025 23:52:00 GMT

Hello sirs,

Any tip how can I get this same Dashboard info but excluding "Servers" and show only the vulnerabilities for Workstation over the last 30 days ?

(this one represents All Endpoints)

Re: Vulnerabilities Over Time Dashboard - Cortex

aspatil — Wed, 02 Apr 2025 15:50:43 GMT

Hello @3SCMAN ,

This is something which is backend created and may not be possible as va_cves dataset has modification date and publication date. Both the filed will be irrelevant, as we you are looking for vulnerabilities on all endpoints over time.
If you run below query, you will find the exact result count, however you cannot turn it into graph, as dataset don't store the count of each day or hour. If we go with Modification date, it changes every day.

dataset = va_cves
| arrayexpand affected_hosts
| join (
dataset = endpoints
// | filter endpoint_type = ENUM.TYPE_WORKSTATION
| fields endpoint_name
) as ep ep.endpoint_name = affected_hosts

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

topic Vulnerabilities Over Time Dashboard - Cortex in Cortex XDR Discussions

Vulnerabilities Over Time Dashboard - Cortex

Re: Vulnerabilities Over Time Dashboard - Cortex