Hello- I'm trying to create a report that groups DNS name with Identification Number (QID) from a vulnerability report. I'm using |stats value(dns) which works well enough, but the problem is a column 'first discovered' may have 3-4 values depending on the instance being scanned: DNS QID First Discovered SLA Status Server-1 Server-2 Server-3 Q-3333 1-1-2021 Overdue Server-4 Server-5 Q-3333 2-1-2021 OK The problem though, is that I need Servers 4-5 to appear with Servers 1-3 under the '1-1-21' date due to SLA requirements (it doesn't matter if a vulnerability when the QID was discovered on a specific device, we're only concerned with it's first detection). Ideally it'd look like this: DNS QID First Discovered SLA Status Server-1 Server-2 Server-3 Server-4 Server-5 Q-3333 1-1-2021 Overdue Here's relevant parts of my query: %base search%
| stats values(DNS) as DNSf BY QID, POAM_ID, Controls, signature, DIAGNOSIS, dvc, OS, firstdisc, duedate, PATCHABLE Thanks!
... View more