topic Re: Vulnerability Management Cortex XDR (first detection date/time) in Cortex XDR Discussions

Vulnerability Management Cortex XDR (first detection date/time)

MathB12 — Wed, 31 Jul 2024 11:35:41 GMT

Hello,

I want to make some reporting and dashboard with the data provided from the agent vulnerabilty Scan.

I would like to obtain the following informations:

How long has a CVE been present on a machine?
How much time elapses between the appearance of a CVE and its disappearance (Hope is due to patching)on a machine?

I find nothing in the template and my squills in XQL are low. If someone can help I would be appreciated 🙂

Most generaly I didn't find any info about the first detection date/time of CVE, is there a field where the info is located ?

Thanks for the help

Re: Vulnerability Management Cortex XDR (first detection date/time)

aspatil — Wed, 31 Jul 2024 11:49:13 GMT

Hello @MathB12 ,

Cortex XDR has a Vulnerability Assessment module that checks against the NIST database and presents a list of vulnerabilities. If a vulnerability is patched, it will simply disappear from the list without changing the status of the CVE to "closed." It does not have management capabilities.

As a result, using XQL, you cannot retrieve information such as the age of the vulnerability, the date of first detection on endpoints, or similar data.

I hope this clarifies things!

Re: Vulnerability Management Cortex XDR (first detection date/time)

MathB12 — Fri, 02 Aug 2024 13:40:26 GMT

Thanks @aspatil That help me , maybe the functionality will come in the next version.

Re: Vulnerability Management Cortex XDR (first detection date/time)

Jeremy.Burdette — Wed, 06 Aug 2025 16:22:15 GMT

Even without a full management system with statuses, it'd be helpful to have the first seen/detected date. The date
would be the last_calculation_time from an existing vulnerability passed forward to a subsequent detection of the same
vulnerability.