All Apps and Add-ons

Not able to generate vulnerability data from a specific account ID

shabaka321
New Member

I have a generated a search query as seen below and I can generate qualys vulnerability data from it, however when I try to append a specific AWS account ID to generate EC2 metadata matching the vulnerability data I get no results.

eventtype=qualys_vm_detection_event | fillnull value=- PROTOCOL DNS | dedup 1 HOST_ID, QID, PROTOCOL, STATUS keepempty=true sortby -_time | search STATUS != "FIXED" | stats list(QID) as QID by OS, DNS, HOST_ID, IP, | lookup qualys_kb_lookup QID OUTPUT TITLE SEVERITY | table OS, DNS, HOST_ID, IP, QID, TITLE, SEVERITY

Is there a way to generate the same data but only from a specific aws account_ID on a table format

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...