Cortex host insight Vulnerability Assessment average severity score

[TCoffey2]

trying to find XQL query that will take all of our severity scores and give us a average and send that to report. I cant seem find the dataset 

Not very good with XQL at this time. maybe someone from the community can help

dataset = host_inventory
| filter 0 is not null and array_length(vulnerabilities) > 0 
| alter vulnerability_scores = array_map(vulnerabilities, vulnerability -> case(
vulnerability.severity == "Critical", 10,
vulnerability.severity == "High", 7,
vulnerability.severity == "Medium", 5,
vulnerability.severity == "Low", 2,
vulnerability.cvss_score, vulnerability.cvss_score, 
0 // Default if severity is unknown
))
| alter average_severity_score = array_avg(vulnerability_scores)
| fields host_name, average_severity_score, timestamp
| sort timestamp desc

[mavega]

Hi,

Thanks for joining Live Community.

You can try using the va_endpoint and va_cves datasets, and then filter as you need.

Example below short query:

|dataset = va_endpoints
| fields cves, endpoint_name, os_type, severity

If you need information on XQL, you can review below:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Get-Started-...

https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction

LIVEcommunity - Cortex XDR Basic XQL Crash Course - LIVEcommunity - 544056

LIVEcommunity - Cortex XDR XQL Use Cases and Applications Crash Course - LIVEcommunity - 544228

If this post solves your inquiry, please mark As Solution.

[aspatil]

Hello,

Below query gives you the average by Endpoint name

dataset = va_endpoints
| filter cves != null
| fields cves , endpoint_name , severity , severity_score
| comp avg(severity_score) as Average_Severity_Score by endpoint_name

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.