This seems like it should be simple, but I can’t find it in the product, and none of the queries on GitHub screamed out “here’s the query.” I basically need the count that shows up on these two dashboard cards for a 90 day period. Right now, the most they will do is 30 days. I think I can get something close for new vulnerability findings by using a simple query builder query on finding.firstFound attribute. However, I can’t find anything that says “tell me the total number of remediation’s in the past 90 days.” Any thoughts on how to pull these two numbers?
I’ll also add, these cards don’t seem to be accurate. When you look at the data behind the card, they seem to list the number of “titled” vulnerabilities found/remediated over the past X days, not the total number of things vulnerable/remediated for all those “titles.” For example, if the only thing new was the “Microsoft CVE-2023-23394: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability,” the New Vulnerability Findings card would say 1. Even though that vulnerability may be found on 5000 different assets. Based on the title of the card, you would think the number should be 5000, not 1. When I look at my data, the New Vulnerability Findings card says 19K for 30 days. However, when you export the card results to a spreadsheet and add up the asset’s affected column, the number is roughly 350K. That’s a big difference.
The console’s sql database does not keep track of remediations and their times currently. The dashboard cards are actually reporting on the cloud API as I’m aware.
You could essentially get those results by querying the cloud api as well though and being sure to post a comparisonTime and currentTime value in.
https://help.rapid7.com/insightvm/en-us/api/integrations.html#operation/searchIntegrationAssets