Vulnerabilty scanned systems per month

[unitrium]

Hi,
I would like to do a search that gives me the number of systems with a vulnerability per month.
I've tried this search but I'm stuck on the _time field, I'm not exactly sure how it works.

| tstats `summariesonly` max(_time) as _time values(Vulnerabilities.severity) as severity from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.dest | `drop_dm_object_name("Vulnerabilities")` |bin span=1mon _time | stats count(dest) as "Scanned systems" by _time

My intuition is that the _time  is some sort of array that contains each time the vulnerability's signature has been detected.  But with my current query I only take the max(_time) which means that all vulnerabilities that have been discovered over 2 months will only be count for the last month.

I really would like to know how I could make them count for each month they have been discovered.
Thanks,

[ITWhisperer]

The first part of your query gets the latest time each Vulnerabilities.dest has appeared in your index. "bin span=1mon _time" groups these by month, giving all events the same value for _time (the month they occurred in). "stats count(dest) as "Scanned systems" by _time" then counts these so you end up with a count for each month of the number of destinations when they were last seen. Is this what you were expecting?

[unitrium]

Not exactly,  I would like to count the vulnerability each time they have been seen in a month not just the latest time they have been seen. Not sure how to handle this with _time.

[ITWhisperer · Accepted solution]

Try something like this:

| tstats `summariesonly` values(Vulnerabilities.severity) as severity from datamodel=Vulnerabilities.Vulnerabilities by _time Vulnerabilities.dest span=1mon | `drop_dm_object_name("Vulnerabilities")`

[unitrium]

Yes that's exactly what I was looking for thanks.