Through the database reads, obtains the MVM each scan task The sweep quantity trend statistic as well as the detailed information inquiry

When the large-scale distributed deployment of the leak-sweeping system into operation, the entire line of nearly 50 branches of the server scanning, the amount of data spikes, as the only administrator, must be flooded, and can not be like before, one by one scan report analysis, and write a scan report, notify the administrator rectification. and mvm its own bug rectification tracking mechanism is no longer applicable, fine-grained ticket function, for branch administrators and themselves are burdens. How to solve it?

After thinking and discussing, decided to transform the role, through the statistics global data, to grasp the Branch Administrator's cooperation support degree, and the branch's overall vulnerability quantity. Through the establishment of vulnerability Information query platform, to provide rectification methods and patch download and other resources. And the specific work is done by the branch administrator himself.

/****** Vulnerability number profile, find available for vulnerability quantity Trend statistics based on task name-configurationname ******/
SELECT [JobID]
/*,[jobname]
, [Configurationid]
, [OrgID]
, [orgname]*/
, [ConfigurationName]
, [StartTime]
, [EndTime]
, [Highvulns]
/*,[MEDIUMVULNS]
, [livehosts]*/
, [Newhighvulns]
, [Removedhighvulns]
/*,[NEWMEDIUMVULNS]
, [Removedmediumvulns]
, [newhosts]
, [removedhosts]*/
from [Faultline]. [Mvmlive]. [Vwscan]
/*

where Configurationname= ' Fh51newyork '
You can also specify a time range

*/
where ConfigurationName like ' fh% '
and Starttime>=getdate ()-7
ORDER BY ConfigurationName

/****** Union of two tables to achieve a new task (change type=1???) Queries for high-risk vulnerabilities, including host IP and vulnerability name ******/
SELECT [Faultline]. [Trend]. [Vulndelta]. [JobID]
, [Faultline]. [Mvmlive]. [Vwscan]. ConfigurationName
, [Faultline]. [Trend]. [Vulndelta]. [AssetID]
, [Faultline]. [dbo]. [Vwassets]. Ipaddressstr
, [Faultline]. [Trend]. [Vulndelta]. [Faultlineid]
, [Faultline]. [Content]. [Vwvulnriskandcvssscore]. Name
, [changetype]
, [dateinserted]
from [Faultline]. [Trend]. [Vulndelta]
Left join [faultline]. [Content]. [Vwvulnriskandcvssscore] on [faultline]. [Trend]. [Vulndelta]. Faultlineid=[faultline]. [Content]. [Vwvulnriskandcvssscore]. Faultlineid
Left join [faultline]. [dbo]. [Vwassets]on [Faultline]. [Trend]. [Vulndelta]. Assetid=[faultline]. [dbo]. [Vwassets]. AssetID
Left join [faultline]. [Mvmlive]. [Vwscan]on [Faultline]. [Trend]. [Vulndelta]. JobID = [Faultline]. [Mvmlive]. [Vwscan]. JobID




/* Select the latest Jobid by task name, plus sort or date. Plus a time frame???

where [faultline]. [Mvmlive]. [Vwscan].configname=fhxxxxx
and [Faultline]. [Trend]. [Vulndelta]. Jobid=max
and [Faultline]. [Content]. [Vwvulnriskandcvssscore]. Risklevel=3

Jobid from [faultline]. [Mvmlive]. [Vwscan] and come



where [faultline]. [Trend]. [Vulndelta]. Jobid= 651
*/
where [faultline]. [Trend]. [Vulndelta]. Dateinserted>=getdate ()-30
and [Faultline]. [Content]. [Vwvulnriskandcvssscore]. Risklevel=3 and [faultline]. [Mvmlive]. [Vwscan]. ConfigurationName like ' fh% '
ORDER BY JobID

This article from "Struggling rookie" blog, declined reprint!

Through the database reads, obtains the MVM each scan task The sweep quantity trend statistic as well as the detailed information inquiry