Query: All vulnerabilities under 29 days

[DavidMoalem1]

I created this query to identify all vulnerabilities under 29 days: 

dataset = va_cves
| alter days = timestamp_diff(current_time(),publication_date ,"DAY")
| filter days > 0 and days < 30
|arrayexpand affected_hosts

Is there a way to tie in IP Addresses from a different dataset (e.g. dataset = endpoints) and match them to the computer names within the endpoint_name field?

[jmazzeo]

Hi @DavidMoalem1, thanks for reaching us using the Live Community.

You can try this XQL query:

dataset = va_cves
| alter days = timestamp_diff(current_time(),publication_date ,"DAY")
| filter days > 0 and days < 30
|arrayexpand affected_hosts
| join (dataset = endpoints | fields endpoint_name as Hostname, ip_address as IP) as endpoints endpoints.Hostname = affected_hosts
| fields Hostname, IP, name, affected_products, severity_score, os_type, description, severity

You can add the required fields as you need.

If this post answers your question, please mark it as the solution.