When I run like this to test combinations, it all works. But when I run in below query to test on one variation, it does not for html tags :
| makeresults
| eval _raw="x-cpe:/a:microsoft:azure_devops_server cpe:/a:microsoft:visual_studio_team_foundation_server"
| rex mode=sed "s/\/ /g"
| rex max_match=0 field=_raw "(?ms)\/\w:(?[^:]+):(?\S+)"
| eval Software=mvrange(0,mvcount(Software_Sub))
| mvexpand Software
| eval Software_Sub=mvindex(Software_Sub,Software)
| eval Software_Main=mvindex(Software_Main,Software)
| fields _raw, Software_Main, Software_Sub
index=abc sourcetype="xyz"
| bin span=24h _time
| makemv delim="," cve
| mvexpand cve
| search cpe="x-cpe:/a:microsoft:azure_devops_server<br/>cpe:/a:microsoft:visual_studio_team_foundation_server"
| stats dc(dns_name) AS Affected_Asset_Count,
latest(category) AS Vuln_Category,
latest(description) AS Description,
latest(vulnPubDate) AS Publication_Date,
latest(firstSeen) AS First_Seen_Date,
latest(lastSeen) AS Last_Seen_Date,
latest(hasBeenMitigated) AS Mitigation_Status,
latest(port) AS Port,
latest(seeAlso) AS Information,
latest(xref) AS External_Reference,
latest(plugin_name) AS Plugin_Name,
latest(plugin_version) AS Plugin_Version,
latest(plugin_family) AS Plugin_Family,
latest(pluginInfo) AS Plugin_Information,
latest(plugin_publication_date) AS Plugin_Publication_Date,
latest(plugin_modification_date) AS Plugin_Modification_Date,
latest(patch_publish_date) AS Patch_Publish_Date
by plugin_id, cve, cvss3_base_score, cpe
| rex mode=sed "s/\/ /g"
| rex max_match=0 field=cpe "(?ms)\/\w:(?[^:]+):(?\S+)"
| rename cpe AS Impacted_Software
| stats dc(Impacted_Software) as count by Impacted_Software, Software_Main, Software_Sub
Thanks in-advance!
... View more