Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Custom widget similar to the standard "Vulnerabilities On All Endpoints Over Time"

Hi,

Is it possible to obtain a custom widget like "Vulnerabilities On All Endpoints Over Time" via XQL?

We would like to filter out some endpoint

Is there a dataset with detailed history information?

Thanks

4 REPLIES 4

L4 Transporter

Hi @Rinaldini_Cristian 

 

Thank you for writing to live community!

 

Yes, you may create a custom widget using XQL. If you are having Host Insights license, then you may use the following datasets and update your XQL query with desired filters according to your use case/requirement.

1. dataset = va_cves  (This dataset contains vulnerability data for applications)

2. dataset = va.endpoints (This dataset contains vulnerability data for endpoints)

 

Snippet for example/reference:

PiyushKohli_0-1690537054938.png


Reference: Datasets-and-Presets

 

Hope this helps!

 

Please mark the response as "Accept as Solution" if it answers your query.

Hi PiyushKohli,

 

thanks for your answer.

We have the Host Insights licence.

We already know these datasets and the way to build a custom widget using XQL.

 

Unfortunately I think that in these datasets there are only data related to last "scan" (day).

Therefore it would be not possible to show historical data like this:

Rinaldini_Cristian_1-1690547888569.png

 

 

Cristian

 

Hi @Rinaldini_Cristian 


Yes, you are correct Host Insights dataset will only have data related to last "scan" (day). However, you may leverage correlation rule to execute XQL query for Host Insights dataset daily and store the result of the XQL query to "Save to dataset" as Action. Now you will have data related to scan for every day as correlation rule executes daily hence overcoming the limit of last "scan" (day) data and therefore now you may use this dataset to create your XQL widget.  

 

Hope this helps!

 

Please mark the response as "Accept as Solution" if it answers your query.


Regards.

L0 Member

Is there an update on this functionality? 
The Built in Widget has the data from the previous month but we need to build and save additional datasets to utilize the same date? 

  • 1261 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!