Forum Discussion
tvm_analyst
7 years agoFrequent Visitor
Calculating remediated vulnerabilities
I have 2 fact tables containing vulnerability data, a finding table and a finding_date table. The finding table is overwritten with the current findings after scans are run, the finding_date t...
- 7 years ago
hi tvm_analyst
you could try something like this:new table = ADDCOLUMNS ( SUMMARIZE ( 'finding_date', 'finding_date'[asset_id], 'finding_date'[vulnerability_id] ), "firstFoundDate", CALCULATE ( MIN ( 'finding_date'[date] ) ),
"lastFoundDate", CALCULATE ( Max ( 'finding_date'[date] ) ) )then, assuming that asset_id and vulnerability_id is unique in the finding-table, create a new column in the new table
isSolvedFlag = IF ( ISBLANK ( LOOKUPVALUE ( 'finding'[date], 'finding'[asset_id], 'new table'[asset_id], 'finding'[vulnerability_id], 'new table'[vulnerability_id] ) ), 1, 0 )and then you should be on you way
tvm_analyst
7 years agoFrequent Visitor
Sure, so below is some sample data. This would assume today is Jan 31st.
(There is a one-to-many relationship between the 2 fact tables, based on the unique_key, if that matters.)
fact_asset_vulnerability_finding_date
| date_written | asset_id | vulnerability_id | unique_key | first_found_date |
| 1/2/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/3/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/4/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/5/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/6/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/7/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/8/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/9/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/10/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/11/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/12/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/13/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/14/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/15/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/16/19 | 2111 | 13456 | 2111-13456 | 1/2/19 |
| 1/17/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/18/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/19/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/20/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/21/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/22/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/23/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/24/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/25/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/26/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/27/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/28/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/29/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
| 1/30/19 | 2112 | 13457 | 2112-13457 | 1/17/19 |
fact_asset_vulnerability_finding
| asset_id | vulnerability_id | unique_key | first_found_date |
| 2112 | 13457 | 2112-13457 | 1/17/19 |
What I am looking to get as output: (remediation_date = MAX(date_written) + 1)
| unique_key | first_found_date | remediation_date |
| 2111-13456 | 1/2/19 | 1/17/19 |
| 2112-13457 | 1/17/19 |