About jlovik

rupkumar4sec · ‎06-10-2021

To get the result you want, you have to use "join" command, where you can use VulnerabilityCVEIDs and common field and get the other fields you need from the main search.

jlovik · ‎03-25-2021

Is there a way to remove any day where the specific event count is 0? I would like to remove any day where the logs did not import. The days with events 0 are throwing off my averages.

jlovik · ‎05-27-2020

Ok so my data is coming from a vulnerability management system. every day i get a dump of every vulnerability in the system. Each unique vulnerability on every asset is given a UniqueAssetVulnID. That id is specific to that vulnerability on that asset day over day. Now I would like to identify when a vulnerability has been remediated IE appeared on yesterdays scan but not on todays scan by Category which is just the severity. This would all be plotted on a area chart. Sample data would be like _time Category UniqueAssetVulnID 05/26/2020 Low 1249+cve-2020-3948 05/27/2020 High 5239+cve-2010-4533 index=rapid7 sourcetype="VulnData" | streamstats current=f last(dc(UniqueAssetVulnID)) as UniqueVulnslast_count by Category | rename UniqueAssetVulnID as current_UniqueAssetVuln | eval delta = UniqueVulnslast_count - current_UniqueAssetVuln | timechart span=1d delta by Category useother=f

richgalloway · ‎05-06-2020

I see a few problems. First, the base search specifies earliest=-12h so only half a day of events is being sent to timechart , which is trying to display events by day. This is minor. Second is a major problem. | where Addtime > disctime is trying compare timestamps in text format, which is not possible. Timestamps must be compared in epoch form. Third, _time must be in epoch form so it's not correct to perform eval _time = strftime... . This is unintuitive because Splunk automatically displays _time in text format. Try this query: index=vuns sourcetype="vulndb" earliest=-12h latest=now | eval Epoch_Time=strptime(VulnerabilityPublishedDate, "%Y-%m-%d") | eval Addtime=relative_time(Epoch_Time, "+30d") | where Addtime > _time | eval _time=Epoch_Time | stats dc(VulnID) as UniqueVulns by Category _time | timechart span=1d values(UniqueVulns) by Category

jlovik · ‎05-05-2020

you are magic. thank you!

jlovik · ‎03-26-2020

This is exactly what i needed to get it all together. I edited it slightly in the final search for clarity. I also missed the tool tip telling me to use $ on both side of the variable in the dashboard which was one of my issues. | eval Epoch_Time=strptime(VulnerabilityPublishedDate, "%Y-%m-%d") | eval Addtime=strftime(Epoch_Time + (30 * 86400), "%Y-%m-%d") | eval Now = strftime(now(), "%Y-%m-%d") | where Addtime < Now

Posts	12
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-25-2020

Online Status	Offline
Date Last Visited	‎06-10-2021 01:45 PM

Storing top result as variable then displaying sys...

Vulnerabilities remediation over time

Getting output of stats command to work in timecha...

How to view my VulnerabilityTitle count deltas ove...

Adding date range modifiers to dashboard input

Re: Storing top result as variable then displaying...

Re: how do I get daily average over a month for al...

Vulnerabilities remediation over time

Re: Getting output of stats command to work in tim...

Re: How to view my VulnerabilityTitle count deltas...

Re: Adding date range modifiers to dashboard input

Join the Conversation