Newly discovered asset with criticals

InsightVM
1

looking for already posted answers about queries can be difficult, so if the answer is out there i apologize.

I am looking for newly discovered assets <16 days and have a critical finding. I have a query that i believe works for the most part except -
the query takes a long time to run > 15 min
i can’t figure out how to detect if the asset itself is newly discovered. which date field would i use

Any guidance is much appreciated. My query -
SELECT da.ip_address AS “IP Address”, dv.title AS “Vuln Title”, dv.description AS “Vuln Description”,
dv.severity_score AS “Severity Score”, dv.date_published AS “Vulnerability Date Published”,
dv.severity AS “Vuln Severity”, dv.exploits AS “Vuln Expoit Count”,fasvi.proof
FROM dim_vulnerability dv
JOIN fact_asset_scan_vulnerability_instance fasvi ON fasvi.vulnerability_id = dv.vulnerability_id
JOIN dim_asset da ON da.asset_id = fasvi.asset_id
JOIN dim_asset_group_asset daga1 ON da.asset_id = daga1.asset_id
where 1=1
AND daga1.asset_group_id = 90
AND dv.cvss_score >= 7
AND “date” > (CURRENT_DATE - INTERVAL ‘15 days’)
limit 40

2

This is where i ended up. it still takes a bit but better

SELECT da.ip_address, da.host_name, favf.asset_id, favf.vulnerability_id, date(fad.first_discovered) AS Asset_Discovered, date(favf.date) AS Date_Vul_First_Found, dv.date_published, dv.severity_score, dv.description
FROM fact_asset_vulnerability_finding favf
JOIN dim_asset da USING (asset_id)
JOIN dim_asset_group_asset daga1 USING (asset_id)
JOIN fact_asset_discovery fad ON da.asset_id = fad.asset_id
JOIN dim_vulnerability dv ON favf.vulnerability_id = dv.vulnerability_id
WHERE 1=1
AND daga1.asset_group_id = 90
AND fad.first_discovered > now() - INTERVAL ‘15 DAYS’
AND dv.severity_score > 8
GROUP BY da.ip_address, da.host_name, favf.asset_id, favf.vulnerability_id, fad.first_discovered, favf.date, dv.date_published, dv.severity_score, dv.description
ORDER BY da.ip_address, favf.vulnerability_id, dv.severity_score DESC
limit 4000