Stats to use for comparison for present VS previous time

[mbasharat]

Hi,

I have below search string:

index=XYZ
| eval ip = mvindex(split(ip_address,"/"),0)
| lookup ABC IP as ip
| stats dc(vuln_id) AS Total by os_name, vuln_id, Organization, Group
| lookup XYZ.csv vuln_id
| fields Organization Group os_name Total cvss_base_score
| rangemap field=cvss_base_score None=0-0 Low=0.1-3.9 Medium=4.0-6.9 High=7.0-8.9 Critical=9.0-10.0
| search range="Critical" AND Organization="$organization$" AND Group="$group$" AND os_name=$os$
| stats count as Total

This gives me vulnerabilities that are Critical for selected Organization, Group and OS. Lets say 1000 vulnerabilities.

What I need now is compare this number with what it was 1 week ago. Something like single value that shows me trend of 1000 plus what was 1 week ago so I can see if applying patches to resolve vulnerabilities have decreased the number or not.

Timechart does it but not the way I need. The above query produces accurate results what I am looking for. It is just that I need to do and show v/s comparison of now VS 1 week ago.

Thanks in-advance.

[skoelpin]

Here's a quick and dirty way. You could also use subsearches or relative_time to accomplish this aswell

index=XYZ earliest=-7d@d latest=now
| eval ip = mvindex(split(ip_address,"/"),0)
| lookup ABC IP as ip
| stats dc(vuln_id) AS Total by os_name, vuln_id, Organization, Group
| lookup XYZ.csv vuln_id
| fields Organization Group os_name Total cvss_base_score
| rangemap field=cvss_base_score None=0-0 Low=0.1-3.9 Medium=4.0-6.9 High=7.0-8.9 Critical=9.0-10.0
| search range="Critical" AND Organization="$organization$" AND Group="$group$" AND os_name=$os$
| timechart span=1d count as Total
| timewrap 1d

[mbasharat]

Hi skoelpin,

Adding the time span in first line as well as last two lines do not produce anything.

earliest=-7d@d latest=now

| timechart span=1d count as Total
| timewrap 1d