Vulnerabilities Over Time Dashboard - Cortex

[3SCMAN]

Hello sirs,

Any tip how can I get this same Dashboard info but excluding "Servers" and show only the vulnerabilities for Workstation over the last 30 days ?

(this one represents All Endpoints)

[aspatil · Accepted solution]

Hello @3SCMAN ,

This is something which is backend created and may not be possible as va_cves dataset has modification date and publication date. Both the filed will be irrelevant, as we you are looking for vulnerabilities on all endpoints over time.
If you run below query, you will find the exact result count, however you cannot turn it into graph, as dataset don't store the count of each day or hour. If we go with Modification date, it changes every day.

dataset = va_cves
| arrayexpand affected_hosts
| join (
dataset = endpoints
// | filter endpoint_type = ENUM.TYPE_WORKSTATION
| fields endpoint_name
) as ep ep.endpoint_name = affected_hosts

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.