Skip to content

Commit 21cedff

Browse files
committed
code info
1 parent a265573 commit 21cedff

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

exposure-management/value-data-connectors.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,24 +80,32 @@ To explore your discovered and ingested data from the external data sources, you
8080

8181
**Examples**:
8282

83+
This query will return all assets retrieved from ServiceNow CMDB and their detailed metadata.
84+
8385
```kusto
8486
ExposureGraphNodes
8587
| where NodeProperties contains ("serviceNowCmdbAssetInfo")
8688
| extend SnowInfo = NodeProperties.rawData.serviceNowCmdbAssetInfo
8789
```
8890

91+
This query will return all assets retrieved from Qualys.
92+
8993
```kusto
9094
ExposureGraphNodes
9195
| where EntityIds contains ("QualysAssetId")
9296
```
9397

98+
This query will return all vulnerabilities (CVEs) reported by Rapid7 on ingested assets.
99+
94100
```kusto
95101
ExposureGraphEdges
96102
| where EdgeLabel == "affecting"
97103
| where tostring(EdgeProperties.rawData.reportInfo.reportedBy) == "rapid7"
98104
| project AssetName = TargetNodeName, CVE = SourceNodeName
99105
```
100106

107+
This query will return all vulnerabilities (CVEs) reported by Tenable on ingested assets.
108+
101109
```kusto
102110
ExposureGraphEdges
103111
| where EdgeLabel == "affecting"
@@ -107,6 +115,7 @@ ExposureGraphEdges
107115

108116
> [!NOTE]
109117
> When troubleshooting Advanced Hunting (AH) queries that don't work or yield no results, note that the "reportedBy" field is case-sensitive. For example, valid values include "rapid7", "tenable", etc.
118+
>
110119
111120
### Attack paths
112121

0 commit comments

Comments
 (0)