What is the equivalent of Exploitable Vulnerability Publish Age by Severity

InsightVM Query Builder
1

I know there’s a card that shows Exploitable Vulnerability Publish Age by Severity but if you click expand it shows the vulnerabilities. I wanted to see the Assets so I could create Remediation Projects and assign them to owners.

What is the equivalent of Exploitable Vulnerability Publish Age by Severity in Query Builder?

How do you show vulnerabilities greater than x days in query builder?

2

Hi Opan,

You could use the vulnerability.datePublished field, select > or >=, pick Relative in the date options and set the range as required.

3

using query builder and vulnerability.datePublished, if I use “<” and select relative then 90 days before today. Will this mean less than 90 days or more than 90 days?

4

Managed to get the data I want but the problem now is when I click an asset it gives me all the vulnerabilities and not just the vulnerabilities I want and you can’t export the result

exploits.size > 0 && vulnerability.severity = ‘critical’ && vulnerability.datePublished < /NOW - P90D/

This query gives me all exploitable vulnerabilities with critical severity and whose publish date is greater than 90 days. It outputs a list of assets with those matching the query. When you click an asset, it will give you all the vulnerabilities of that asset instead of just seeing vulnerability with critical severity and you can’t export it to a CSV file.

Short of using an LLM to extract and output what I need. How can I

  1. filter exploitable vulnerabilities with critical severity whose publish date is greater than 90 days (DONE)
  2. see assets affected that match those query (DONE)
  3. see the vulnerability list when I click an asset and be able to export the vulnerability to a CSV file and at the same time do a “Create Project” so I can assign those vulnerability to a person for him to remediate? >>> how?

there is another Tab that you can see when you do a query, the “Vulnerabilities” tab, but it shows vulnerabilities view WITHOUT the assets so it’s not that much useful.

What I need is the see Assets and the accompanying exploitable critical vulnerability that I can export to a CSV so I can track