Vulnerability Management Cortex XDR (first detection date/time)

[MathB12]

Hello,

I want to make some reporting and dashboard with the data provided from the agent vulnerabilty Scan.

I would like to obtain the following informations:

1. How long has a CVE been present on a machine?
2. How much time elapses between the appearance of a CVE and its disappearance (Hope is due to patching)on a machine?

I find nothing in the template and my squills in XQL are low. If someone can help I would be appreciated 🙂

Most generaly I didn't find any info about the first detection date/time of CVE, is there a field where the info is located ?

Thanks for the help

[aspatil · Accepted solution]

Hello @MathB12 ,

Cortex XDR has a Vulnerability Assessment module that checks against the NIST database and presents a list of vulnerabilities. If a vulnerability is patched, it will simply disappear from the list without changing the status of the CVE to "closed." It does not have management capabilities.

As a result, using XQL, you cannot retrieve information such as the age of the vulnerability, the date of first detection on endpoints, or similar data.

I hope this clarifies things!

[MathB12]

Thanks @aspatil That help me , maybe the functionality will come in the next version.