Cortex XDR XQL query to get list of all vulnerabilities

[tejaspatil12]

Hello All, 

Could someone assist me with a Cortex XDR XQL query to list all vulnerabilities along with their associated endpoints? I'm looking for a list that includes each endpoint and its unique CVEs.

also Does Cortex XDR gives remediation details along with vulnerability ?

Cortex XDR   #Hostinsight

[tlmarques]

Hi @tejaspatil12 ,

Using XQL, you can view CVEs for all or specific endpoints:

dataset = va_cves
| fields name, cve_id , severity , severity_score, affected_hosts
|arrayexpand affected_hosts
| join(preset = host_inventory_endpoints | fields endpoint_name, operating_system , endpoint_type, last_report_time )
as ep ep.endpoint_name = affected_hosts
| filter (`affected_hosts` = """XTP""")

I believe XDR does not provide remediation or solution details.

On the Vulnerability page, for each CVE, you can find the NIST link, which will take you to the NIST page for more details.