I have nessus data for Installed Windows Updates (PluginID 52001).
Here is a list of quick-fix engineering updates installed on the
remote system :
+ KB4091664
- Description : Update
- InstalledOn : 1/22/2019
+ KB4132216
- Description : Update
- InstalledOn : 6/28/2018
+ KB4465659
- Description : Security Update
- InstalledOn : 1/19/2019
+ KB4480977
- Description : Update
- InstalledOn : 1/22/2019
Note that for detailed information on installed QFE's such as InstalledBy, Caption,
and so on, please run the scan with 'Report Verbosity' set to 'verbose'.
or in raw
...\nHere is a list of quick-fix engineering updates installed on the\nremote system :\n\n+ KB4091664\n - Description : Update\n - InstalledOn : 1/22/2019\n\n+ KB4132216\n - Description : Update\n - InstalledOn : 6/28/2018\n\n+ KB4465659\n - Description : Security Update\n - InstalledOn : 1/19/2019\n\n+ KB4480977\n - Description : Update\n - InstalledOn : 1/22/2019\n\nNote that for detailed information on installed QFE's such as InstalledBy, Caption,\nand so on, please run the scan with 'Report Verbosity' set to 'verbose'.\n...
I tried using the field extractor to no avail.
Need HotFixID, HotFixDesc, HotFixInstalledOn
Hi there @rayaivy
Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"
Hi there @rayaivy
Try like this.
... | rex max_match=0 "(?<HotFixID>KB\d+)[^\-]+-\sDescription\s:\s(?<HotFixDesc>[^\-]+)-\sInstalledOn\s:\s(?<HotFixInstalledOn>[\d\/]+)"
index=nessus pluginID=52001
| rex max_match=0 "(?<HFID>KB\d+)[^\-]+-\sDescription\s:\s(?<HFDesc>[^\-]+)-\sInstalledOn\s:\s(?<InDate>[\d\/]+)"
| eval allVals=mvzip(HFID,mvzip(HFDesc, InDate,"~"),"~")
| expand allVals
| rex field=allVals "(?<HotFixID>[^~]+)~(?<HotFixDesc>[^~]+)~(?<InstallDate>.*)"
| table dnsName, HotFixID, HotFixDesc, InstallDate