Dashboards & Visualizations

Comparing two Nessus Scans

clavelle
New Member

Where I work we are using Nessus to scan for vulnerabilities weekly. I'm in the process fo building a dashboard and making it all pretty for management. What I want to be able to do is compare the last two scans and get a difference between the total vulnerability of this weeks scan and the last one.

I don't have any input to provide and I couldn't find anything else on the Googles.

Thanks!

0 Karma

thambisetty
Super Champion

Hi @CarsonZa,

If you have got Splunk Enterprise security contains macro make_previous_time_range(2) it takes two parameters earliest time and latest time as input.

for example, if you need to compare data today and yesterday you need to choose todays date and yesterday date will be automatically calculated using above mentioned macro.

————————————
If this helps, give a like below.
0 Karma

CarsonZa
Contributor

ES wasn't mentioned in the original question but yes you are correct that macro does exist inside SA-Util

0 Karma

CarsonZa
Contributor

run a subsearch using |join.

"search"
| join type=inner 
    [ |search "search" earliest=x latest=x] 

Set the time picker as two weeks prior, the sub search would be the current time range. This should only show you events that were persistent between the two weeks

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Join

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...