I'm building an app to manage Nessus vulnerability data and grab CVE data from the National Vulnerability Database (NVDB). The search does the following:
Searches for all Nessus plugin scripts
Dedupes events by Nessus ID
Replaces a number of field values to make them human readable
Performs a lookup by Nessus ID and returns any CVE IDs associated with the plugin
Some plugins have one or more CVE IDs. Some don't have any. When I pipe that search to the mvexpand command, events without CVE IDs disappear from the search results.
Is there an easy way to make the mvexpand command conditional only on events that have a CVE ID?
This is old, so I'm sure you've figured it out, but a question deserves an answer...
You need to use
fillnull value="-" CVEID
before the mvexpand to not lose records that have no CVEID value.