Hi All, Im working with some vulnerability data and I'm wondering if I can sort the list I have of different vulnerability ratings the way I want it to look. So far I have come up empty on ideas.
At the moment the data is being sorted alphabetically and looks like this:
Critical Severity
High Severity
Informative
Low Severity
Medium Severity
I'd like it to look like this:
Critical Severity
High Severity
Medium Severity
Low Severity
Informative
Possible?
Thanks!
At the point that you have something like this:
| stats values(severity) AS severity BY host
Add this after it:
| rex field=severity mode=sed "s/(Critical Severity)/5:\1/ s/(High Severity)/4:\1/ s/(Medium Severity)/3:\1/ s/(Low Severity)/2:\1/ s/(Informative)/1:\1/"
Then do it again to cause it to be resorted:
| stats values(severity) AS severity BY host
You could do this before you do the stats
but then you are changing millions of events instead of a few.
P.S. Yes, this is backwards from your perfect desire but should be close enough. If you REALLY need it the other way, then you can do this instead:
| rex field=severity mode=sed "s/(Critical Severity)/ \1/ s/(High Severity)/ \1/ s/(Medium Severity)/ \1/ s/(Low Severity)/ \1/"
At the point that you have something like this:
| stats values(severity) AS severity BY host
Add this after it:
| rex field=severity mode=sed "s/(Critical Severity)/5:\1/ s/(High Severity)/4:\1/ s/(Medium Severity)/3:\1/ s/(Low Severity)/2:\1/ s/(Informative)/1:\1/"
Then do it again to cause it to be resorted:
| stats values(severity) AS severity BY host
You could do this before you do the stats
but then you are changing millions of events instead of a few.
P.S. Yes, this is backwards from your perfect desire but should be close enough. If you REALLY need it the other way, then you can do this instead:
| rex field=severity mode=sed "s/(Critical Severity)/ \1/ s/(High Severity)/ \1/ s/(Medium Severity)/ \1/ s/(Low Severity)/ \1/"
Wonderful!
This worked a treat:
| eval sevdesc='severity.description'
| stats count by "Custom Tag", sevdesc
| rex field=sevdesc mode=sed "s/(Critical Severity)/ \1/ s/(High Severity)/ \1/ s/(Medium Severity)/ \1/ s/(Low Severity)/ \1/"
| stats list(count), values(sevdesc) by "Custom Tag"
| sort values(sevdesc), -list(count)
| rename "Custom Tag" AS Application list(count) AS Count values(sevdesc) AS Severity
Thanks!