XQL removes endpoint CVEs and ALL information

[HCSammyChou]

I want to remove all information related to the endpoint "ABC". However, with the following xql query, it only removes cves that are exclusively associated with this endpoint. If a cves is associated with multiple endpoints, the affected_products, affected_hosts, and affected_hosts_count fields still display information related to "ABC".

How should I modify the query so that no information about"ABC" appears in the cves, even if the cves affects multiple endpoints?

MY xql QUERY:

dataset = va_cves
| filter affected_hosts != "ABC"
| filter severity >=low
| filter affected_hosts_count >=1
| fields name as CVE, severity , severity_score ,type as APPLICATION_OPERATINGSYSTEM,description ,affected_products, affected_hosts ,affected_hosts_count,publication_date
|sort desc publication_date

[aspatil]

Hello @HCSammyChou ,

Below query should help!

dataset = va_cves
|arrayexpand affected_hosts
|filter affected_hosts != "abc"
| filter severity >=low
| filter affected_hosts_count >=1
| fields name as CVE, severity , severity_score ,type as APPLICATION_OPERATINGSYSTEM,description ,affected_products, affected_hosts ,affected_hosts_count,publication_date
|sort desc publication_date

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

[HCSammyChou]

This is not the answer I am looking for. In this way, the affected products of the endpoint  "abc"  will still be displayed in affected_products

[aspatil]

Cannot understand your requirement. Your ask was I want to remove all information related to the endpoint "ABC".  I have provided you the sample query which excludes the host. The affected product can be applied to multiple hosts, hence it will be displayed. To understand more please open CS case.