KQL时间图漏洞数

Question

我有一个查询，它获取在Azure容器注册表中的镜像中发现的唯一漏洞的数量：

securityresources
 | where type == 'microsoft.security/assessments/subassessments'
 | where id matches regex  '(.+?)/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/'
 | parse id with  registryResourceId '/providers/Microsoft.Security/assessments/' *
 | parse registryResourceId with  * "/providers/Microsoft.ContainerRegistry/registries/" registryName
 | extend imageDigest = tostring(properties.additionalData.imageDigest), repository = tostring(properties.additionalData.repositoryName)
 | project
         registryName, 
         repository, 
         imageDigest,
         severity = properties.status.severity,
         vulnId = properties.id,
         displayName = properties.displayName,
         description = properties.description,
         remediation = properties.remediation,
         category = properties.category,
         impact = properties.impact,
         timeGenerated = properties.timeGenerated
| distinct tostring(vulnId)
| summarize count()

我希望有一个图表来显示一段时间内的漏洞数量，这样我们就可以(直观地)看到漏洞的数量正在下降(或上升)，但我不知道如何做到这一点。希望有人能帮助我实现这一点。

Answer 1

请尝试执行以下任一操作，而不是distinct tostring(vulnId) | summarize count()：

• summarize dcount() by bin(timeGenerated, 1h)
• make-series dcount() on timeGenerated step 1h

然后在末尾添加一个| render timechart

例如：

securityresources
| where type == 'microsoft.security/assessments/subassessments'
| where id matches regex  '(.+?)/providers/Microsoft.Security/assessments/dbd0cb49-b563-5e7-9724-889e799fa648/'
| extend vulnId = tostring(properties.id)
| summarize dcount(vulnId) by bin(timeGenerated, 1h)
| render timechart