Dashboards & Visualizations

Comparing two Nessus Scans

clavelle
New Member

Where I work we are using Nessus to scan for vulnerabilities weekly. I'm in the process fo building a dashboard and making it all pretty for management. What I want to be able to do is compare the last two scans and get a difference between the total vulnerability of this weeks scan and the last one.

I don't have any input to provide and I couldn't find anything else on the Googles.

Thanks!

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi @CarsonZa,

If you have got Splunk Enterprise security contains macro make_previous_time_range(2) it takes two parameters earliest time and latest time as input.

for example, if you need to compare data today and yesterday you need to choose todays date and yesterday date will be automatically calculated using above mentioned macro.

————————————
If this helps, give a like below.
0 Karma

CarsonZa
Contributor

ES wasn't mentioned in the original question but yes you are correct that macro does exist inside SA-Util

0 Karma

CarsonZa
Contributor

run a subsearch using |join.

"search"
| join type=inner 
    [ |search "search" earliest=x latest=x] 

Set the time picker as two weeks prior, the sub search would be the current time range. This should only show you events that were persistent between the two weeks

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...