How to query for Vulnerability Assessment Data

[JamesWiggins]

I would like to query XDR externally for the data stored in the Host Insights > Vulnerability Assessment page. 

I looked through all of the available APIs, but none of them seem to have data related to CVEs. I would not be opposed to writing a custom XQL query for this data, but I do not see fields related to CVE's in the xdr_data schema either.. is it in there somewhere and I just missed it? 

I know I can manually export the data to file on the page, but I need to accomplish this programmatically. 

Any tips on how I could go about extracting this data?

[SilviuMihailDascalu]

Hi @JamesWiggins ,

Thanks for posting to our Live Community discussion board. At the moment information about CVE is only available inside the UI (via export function). As an alternative you can create a custom dataset containing the vulnerabilities in the CSV format and be able to map it against other datasets.

Let me know if you got any questions or concerns!

Thanks,

Silviu

Thanks,

Silviu

[JamesWiggins]

Thanks for the reply! Can you elaborate on what you mean by "create a custom dataset"?

Are you talking about just using the export function to create a CSV? 

[Cyber1985]

I think he means you can upload it as a lookup.  

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/dtrh-finding-new-xql-fields-and-joining-...

BR

Rob