Cyber Security: Vulnerabilities
Description
The Vulnerabilities section monitors vulnerability scan results.
Displayed Data
- statistics on unique scanned hosts with vulnerabilities of different severity levels
- statistics by vulnerability type
- trends by vulnerability type
- hosts with the most vulnerabilities
- most common vulnerabilities
- vulnerability statistics by CVE type
- event statistics broken down by vulnerable host
- event statistics broken down by vulnerability
List of Dashboards
The section includes three dashboards.
Vulnerabilities: Overview
Vulnerabilities: Vulnerability Type Profile
Vulnerabilities: Vulnerable Host Profile
Data Model
The section uses the data source fields described below. Alias used: sm_cs_vulnerability_indexes.
Categorization Fields
| Field Name | Value |
|---|---|
event.kind | event |
event.category | vulnerability |
General Purpose Fields
Vulnerability Characteristics vulnerability
| Field Name | Value |
|---|---|
vulnerability.enumeration | Type of vulnerability classification (CVE, etc.). |
vulnerability.id | Identifier of the vulnerability within the classification. |
vulnerability.classification | Vulnerability danger scoring system (CVSS, etc.). |
vulnerability.score.base | Degree of vulnerability danger (0-10). |
vulnerability.score.version | Version of the scoring system. |
vulnerability.severity | Importance level of the vulnerability (critical | high | medium | low | none) |
Vulnerability Detection Location host
| Field Name | Value |
|---|---|
host.ip | IP address of the host where the vulnerability was detected. |
host.name | Name of the host where the vulnerability was detected. |
Other Fields
| Field Name | Value |
|---|---|
event.original | Original event text. |
Dictionaries
Dictionaries are not applied.