How to match my list of qualys events against the list of CVEs found in the KEV lookup?

[TheBravoSierra]

Hi,

I'm looking to match my list of qualys events against the list of CVEs found in the KEV lookup on cisa.gov. I'm not having any success with the below search.  Can you provide any guidance? 

For example,

 index=qualys  *[|inputlookup cisa_cve.csv | fields cveID]*

I need to find my events where my base search that shows CVE contains matches to the KEV lookup returned field. 

Any help is greatly appreciated.

Thanks

[gcusello]

Hi @TheBravoSierra,

you cannot put a subsearch adding the asterisks in main search, you have to modify your search.

In addition, have you the cveID field both in the lookup and in the qualys index? remeber that to use a subsearch you need to have the same field name both in main search and subsearch.

Anyway, you could run something like this:

index=qualys [ | inputlookup cisa_cve.csv | rename cveID AS query | fields query ]
| ...

in this way you make a full text search in the qualys index using the lookup cveID field.

Ciao.

Giuseppe