XML multivalue: N vulnerabilities per Host id

[mzorzi]

I have a long xml file with many < host id> stanzas. Each one of these stanza has an < ip> value associated and many < vulnerability id> stanzas. Each one of these has a set of 3 values made of < score> < port> < protocol>

this is an extract:

<hosts>
  <host id="565558" persistent_id="98487">
    <ip>85.205.34.28</ip>
     <vulnerabilities>
      <vulnerability id="2099" custom="0">
        <score>8671</score>
        <port>0</port>
        <protocol>smb</protocol>
      </vulnerability id>
    </vulnerabilities>
  </host id>
  <host id="565560" persistent_id="98485">
    <ip>85.205.34.27</ip>
    <vulnerabilities>
      <vulnerability id="552" custom="0">
        <score>8</score>
        <port>137</port>
        <protocol>udp</protocol>
      </vulnerability id>
     <vulnerability id="1492" custom="0">
        <score>0</score>
        <port>139</port>
        <protocol>tcp</protocol>
      </vulnerability id>
</vulnerabilities>

I would like to create searches that:

1) Give me all vulnerabilities with vulnerability id=552 and port=137 and make a result table with fields ip, vulnerability id, port, score

2) Give me all hosts / ips with existing risks with a score higher than 5000 and make a result table with fields ip,score, vulnerability id, port

How can I achieve this?

[bbingham]

Can you post how your events are broken? Are they multi-line? Next do you have the xml field extractions on?

Making an assumption that you have events being grouped by xml blocks, and you have your events are broken by the "host_id" block. I'm also assuming that you have extractions on your fields. (if you're not check out this post: Xml Inputs)

search vulnerability_id=552 port=137 | table ip,vulnerability_id,port,score

search score>=5000 | table ip,score,vulnerability_id,port

if you're data isn't broken by the host_id block, your search can get a lot more complex, so please let me know how your events are being broken. If your events are broken on every line, you may need to use either the transaction command or the stats command to combine your events, and then use a post processing search.