Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

XPOST - Modify NCM firmware vulnerabilities modern dashboard widget

This is cross posted in the Orion Platform Forum. Adding here since I didn't get any traction on the first question. Moderators, please feel free to remove the original post.

The default NCM Firmware Vulnerabilities widget seems to be showing all vulnerabilities even the ones that I've marked as non-applicable. I was showing a total of 10,031 total vulnerabilities on the widget with 3928 as high, 3348 as medium, and 2755 as low. When I went through my list of vulnerabilities and cleared out a bunch affecting multiple nodes as non-applicable the numbers never change. How can I can the SWQL to filter out entries I have deemed don't affect me?

SELECT 'High' as Severity, '#dd2c00' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score >= 7.0
UNION ALL
(SELECT 'Medium' as Severity, '#fec406' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score >= 4.0 AND Announcements.Score < 7.0)
UNION ALL
(SELECT 'Low' as Severity, '#1d8fb2' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score < 4.0 )

Find more posts tagged with

Accepted answers

joshuamichaelsanders

I think I got it. Downloaded the SWQL Studio so I could see the database structure. I found 'state'.

SELECT 'High' as Severity, '#dd2c00' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score >= 7.0 AND Nodes.State != 3
UNION ALL
(SELECT 'Medium' as Severity, '#fec406' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score >= 4.0 AND Announcements.Score < 7.0 AND Nodes.State !=3)
UNION ALL
(SELECT 'Low' as Severity, '#1d8fb2' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score < 4.0  AND Nodes.State !=3)

All comments

marcrobinson

THe quick (or ugly) answer is to filter on custom properties, device types, parts of names, etc. As you know which devices you need to filter on, you have a head start. Custom properties can be used to filter which ones are important, like "EDGE Router = True" or "DMZ Firewall = True." If you have existing properties that can help you filter, so much the better. These properties then go in that where clause and you eliminate clutter.

joshuamichaelsanders

yeah but I'm trying to filter out vulnerabilities, there are multiple that are assigned to specific nodes. If I filter out nodes then I'll be filtering active AND non-applicable vulnerabilities. I'll dive back into it but I'm not sure I'm understanding the direction you are suggesting.

joshuamichaelsanders

I think I got it. Downloaded the SWQL Studio so I could see the database structure. I found 'state'.

SELECT 'High' as Severity, '#dd2c00' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score >= 7.0 AND Nodes.State != 3
UNION ALL
(SELECT 'Medium' as Severity, '#fec406' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score >= 4.0 AND Announcements.Score < 7.0 AND Nodes.State !=3)
UNION ALL
(SELECT 'Low' as Severity, '#1d8fb2' as Color, COUNT (1) as theCount, '/Orion/Report.aspx?Report=Vulnerabilities+for+each+Node' as Link
FROM NCM.VulnerabilitiesAnnouncements as Announcements
JOIN NCM.VulnerabilitiesAnnouncementsNodes as Nodes
ON Announcements.EntryId= NODES.EntryId
WHERE Announcements.Score < 4.0  AND Nodes.State !=3)

marcrobinson

Bingo! Yes you can filter on the score/severity items. You may want to swap out the report name for the reportID. Just load it from report manager and you can quickly get it.

If and probably when you need to filter based on device models or custom properties, you should be able to add those to your filters. If you get stuck - post to thwack for help.

I ran your query and it worked fine.