XQL removes endpoint CVEs and ALL information

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL removes endpoint CVEs and ALL information

L1 Bithead

I want to remove all information related to the endpoint "ABC". However, with the following xql query, it only removes cves that are exclusively associated with this endpoint. If a cves is associated with multiple endpoints, the affected_products, affected_hosts, and affected_hosts_count fields still display information related to "ABC".

How should I modify the query so that no information about"ABC" appears in the cves, even if the cves affects multiple endpoints?

 

MY xql QUERY:

dataset = va_cves
| filter affected_hosts != "ABC"
| filter severity >=low
| filter affected_hosts_count >=1
| fields name as CVE, severity , severity_score ,type as APPLICATION_OPERATINGSYSTEM,description ,affected_products, affected_hosts ,affected_hosts_count,publication_date
|sort desc publication_date





3 REPLIES 3

L6 Presenter

Hello @HCSammyChou ,

 

Below query should help!

 

dataset = va_cves
|arrayexpand affected_hosts
|filter affected_hosts != "abc"
| filter severity >=low
| filter affected_hosts_count >=1
| fields name as CVE, severity , severity_score ,type as APPLICATION_OPERATINGSYSTEM,description ,affected_products, affected_hosts ,affected_hosts_count,publication_date
|sort desc publication_date

 

 

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.

Ashutosh Patil

This is not the answer I am looking for. In this way, the affected products of the endpoint  "abc"  will still be displayed in affected_products

 

L6 Presenter

Cannot understand your requirement. Your ask was I want to remove all information related to the endpoint "ABC".  I have provided you the sample query which excludes the host. The affected product can be applied to multiple hosts, hence it will be displayed. To understand more please open CS case.

Ashutosh Patil
  • 573 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!