Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

[Rinaldini_Cristian]

Hi,

Is it possible to obtain a custom widget like "Vulnerabilities On All Endpoints Over Time" via XQL?

We would like to filter out some endpoint

Is there a dataset with detailed history information?

Thanks

[PiyushKohli]

Hi @Rinaldini_Cristian 

Thank you for writing to live community!

Yes, you may create a custom widget using XQL. If you are having Host Insights license, then you may use the following datasets and update your XQL query with desired filters according to your use case/requirement.

1. dataset = va_cves  (This dataset contains vulnerability data for applications)

2. dataset = va.endpoints (This dataset contains vulnerability data for endpoints)

Snippet for example/reference:

Reference: Datasets-and-Presets

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[Rinaldini_Cristian]

Hi PiyushKohli,

thanks for your answer.

We have the Host Insights licence.

We already know these datasets and the way to build a custom widget using XQL.

Unfortunately I think that in these datasets there are only data related to last "scan" (day).

Therefore it would be not possible to show historical data like this:

Cristian

[PiyushKohli]

Hi @Rinaldini_Cristian 

Yes, you are correct Host Insights dataset will only have data related to last "scan" (day). However, you may leverage correlation rule to execute XQL query for Host Insights dataset daily and store the result of the XQL query to "Save to dataset" as Action. Now you will have data related to scan for every day as correlation rule executes daily hence overcoming the limit of last "scan" (day) data and therefore now you may use this dataset to create your XQL widget.  

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.