Hello,
I´m having a little issue with Enterprise Scanner/SiteProtector:
We have a corporate event correlation system which is receiving events from my
security devices and corporate applications.
The IPS data (from sensordata1) is already being imported into our system. Now
I need to do a query to feed the correlation system with the results from the
scanning sessions.
The SiteProtector table schema is slightly different from the InternetScanner,
so I couldn't figure out how to query de data.
If I was using Internet scanner the query woud be:
SELECT
dbo.Hosts.ipAddressStr ip,
dbo.Hosts.DNSName hostName,
dbo.Hosts.osName osName,
dbo.Hosts.revisionLevel revisionLevel,
dbo.VulnsFound.vulnID vulnID,
dbo.Hosts.hostID hostID
dbo.VulnsFound.SeqNo seqNum,
dbo.Vulns.vulnName vulnName,
dbo.Vulns.vulnTag vulnTag,
dbo.Vulns.severity severity,
dbo.Vulns.shortDesc shortDesc,
dbo.Vulns.osAffected osAffected,
dbo.Vulns.fix fix,
dbo.Vulns.fullDesc fullDesc,
dbo.VulnsFound.assocInfo assocInfo,
FROM
dbo.VulnsFound LEFT JOIN dbo.Hosts ON dbo.VulnsFound.hostID = dbo.Hosts.hostID
LEFT JOIN Vulns ON dbo.VulnsFound.vulnID = dbo.Vulns.vulnID
WHERE
dbo.VulnsFound.jobID = {i_jobid} AND dbo.VulnsFound.SeqNo > {i_seqnum} ORDER BY
dbo.VulnsFound.jobID, dbo.Hosts.HostID ASC
Any of you could help me to build a query to retrieve the same (or simmilar)
results from SiteProtector?
Thanks in advance
Julio Pontes
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
