Splunk Search

Qualys: Vulnerabilites Up trend/Down trend Over Last 7 Days

sammygarcia
New Member

I am trying to put together a search that shows all of my vulnerabilities in Qualys for all of my servers that are being scanned. I want to be able to show vulnerability increase or decrease from the scan that runs every week. I have put together the following search that shows me the amount of vulnerabilities that were fixed during the last patching window and scan cycle but I think I am making the end goal way more complicated than it should be. Thanks for any help anyone can provide!

index=qualys IP=* STATUS=FIXED
| convert mktime(LAST_FIXED_DATETIME) timeformat=%Y-%m-%dT%H:%M:%S%Z
| eval lfd=round(relative_time(now(), "-7d@d"))
| where LAST_FIXED_DATETIME >= lfd
| eval isitfixed=if(STATUS="FIXED","yes","no")
| streamstats count(eval(isitfixed="yes")) as Fixed
| timechart last(Fixed) AS Fixed span=7d

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...