Hi, I would like to create a graph showing the average vulnerability age for each month by severity. I use this search :     | tstats `summariesonly` min(_time) as firstTime,max(_time) as lastTime,count from datamodel=Vulnerabilities.Vulnerabilities by _time Vulnerabilities.signature,Vulnerabilities.dest, Vulnerabilities.severity span=1mon | `drop_dm_object_name("Vulnerabilities")` | where firstTime!=lastTime AND severity!="informational" | eval age=round((lastTime-firstTime)/86400) | eval _time=lastTime | timechart span=1mon avg(age) by severity | fields _time low medium high critical     However the age is calculated independently for each month. Meaning that if a vulnerability spans over multiple month its age will cap at 30 days maximum for each month in the graph. I'm unsure of how to make it cumulative  ... View more

Hi, I would like to do a search that gives me the number of systems with a vulnerability per month. I've tried this search but I'm stuck on the _time field, I'm not exactly sure how it works.     | tstats `summariesonly` max(_time) as _time values(Vulnerabilities.severity) as severity from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.dest | `drop_dm_object_name("Vulnerabilities")` |bin span=1mon _time | stats count(dest) as "Scanned systems" by _time     My intuition is that the _time  is some sort of array that contains each time the vulnerability's signature has been detected.  But with my current query I only take the max(_time) which means that all vulnerabilities that have been discovered over 2 months will only be count for the last month. I really would like to know how I could make them count for each month they have been discovered. Thanks, ... View more

Hi , I'm trying to build a single value dashboard for certain metrics. I would like to put it in the form of a timechart so I can have a trend value. However this search gives me no result :       | tstats `summariesonly` min(_time) as firstTime,max(_time) as lastTime,count from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.signature,Vulnerabilities.dest, Vulnerabilities.severity | `drop_dm_object_name("Vulnerabilities")` | where firstTime!=lastTime AND severity!="informational" | eval age=round((lastTime-firstTime)/86400) | timechart span=30d avg(age) by lastTime       Which is strange because I feel like this command is almost the same :       | tstats `summariesonly` min(_time) as firstTime,max(_time) as lastTime,count from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.signature,Vulnerabilities.dest, Vulnerabilities.severity | `drop_dm_object_name("Vulnerabilities")` | where firstTime!=lastTime AND severity!="informational" | eval age=round((lastTime-firstTime)/86400) | bucket lastTime span=30d | stats avg(age) by lastTime       And this one returns me the results that I want. Could anybody help me out getting a timechart out of this ? ... View more