MENU
An engineer needs to create a new report capturing the vendors and products that detect a particular CVE in their environment. How can they ensure that the search associated with the report only includes accelerated data?
The appropriate approach is to query the Vulnerabilities data model using tstats, constrain the results to the particular CVE, and group or aggregate the results by vendor_product. This satisfies both requirements in the question: selecting vulnerability
information associated with a CVE and ensuring that the search operates against accelerated data.
tstats is specifically designed to query indexed fields and accelerated data-model summaries efficiently. In conceptual form, the analytic follows this structure:
| tstats ... from datamodel=Vulnerabilities... where ...cve=<value> by ...vendor_product
The exact field prefix depends on the dataset being addressed, but the architectural principle is the same: use the accelerated Vulnerabilities data model rather than scanning raw vulnerability events.
The Updates data model is not the appropriate semantic domain for reporting products associated with identified vulnerabilities. Likewise, simply searching for vendor_product without constraining the requested CVE would not satisfy the report requirement.
This question reinforces a recurring Cybersecurity Defense Engineer theme: choose the correct CIM domain and use accelerated-search mechanisms when operational reporting must scale efficiently.
Study Guide topics: Vulnerabilities data model, tstats, accelerated data, CVE reporting, vendor_product, search optimization.
Currently there are no comments in this discussion, be the first to comment!