Security data query examples

This guide provides ready-to-use NRQL queries for common security monitoring and analysis scenarios. Copy these queries into the query builder or add them to custom dashboards to gain deeper insights into your vulnerability data.

For information about the underlying data structure, see Security data structure reference.

Important

These queries are written against the real Vulnerability event schema. Note the following schema limitations:

The Vulnerability event has no state or lifecycle field — queries cannot filter by OPEN/CLOSED status.
There is no resolvedAt field — MTTR and remediation velocity queries that require a resolved timestamp cannot be reproduced from this event.
cvss.score and epss.percentile are stored as strings. Use numeric() to cast them before comparing or aggregating numerically.
ORDER BY numeric(...) is not supported. Alias the cast in SELECT and use LIMIT to retrieve top results.
HAVING on faceted aggregates is not supported. Use LIMIT to return top-N results instead.

Executive reporting

Total open vulnerabilities by severity

Get a high-level view of your vulnerability exposure:

FROM Vulnerability
SELECT count(*) AS 'Total Vulnerabilities'
FACET severity
SINCE 7 days ago

Critical and high severity trends

Track how critical vulnerabilities change over time:

FROM Vulnerability
SELECT count(*) AS 'Critical & High Vulnerabilities'
WHERE severity IN ('CRITICAL', 'HIGH')
TIMESERIES AUTO
SINCE 7 days ago

Vulnerabilities by entity

Identify which applications or hosts have the most vulnerabilities:

FROM Vulnerability
SELECT count(*) AS 'Vulnerability Count'
FACET entityLookupValue
LIMIT 20
SINCE 7 days ago

Vulnerability distribution across portfolio

Understand the spread of vulnerabilities:

FROM Vulnerability
SELECT percentage(count(*), WHERE severity = 'CRITICAL') AS 'Critical %',
       percentage(count(*), WHERE severity = 'HIGH') AS 'High %',
       percentage(count(*), WHERE severity = 'MEDIUM') AS 'Medium %',
       percentage(count(*), WHERE severity = 'LOW') AS 'Low %'
SINCE 7 days ago

Prioritization and risk assessment

High-priority vulnerabilities

Find vulnerabilities with high exploit probability:

FROM Vulnerability
SELECT cve, package, package.version,
       numeric(cvss.score) AS 'cvssScore',
       numeric(epss.percentile) AS 'epssPercentile'
WHERE numeric(epss.percentile) > 0.9
SINCE 30 days ago
LIMIT 20

High-exploitability vulnerabilities

Identify vulnerabilities with a known exploit:

FROM Vulnerability
SELECT count(*) AS 'Findings', max(numeric(cvss.score)) AS 'Max CVSS'
WHERE exploitKnown = 'true'
FACET cve, entityLookupValue, package
SINCE 30 days ago

Tip

The Vulnerability event does not have an activeRansomware field. This query uses exploitKnown as the closest available indicator for high-risk findings. If this query returns no results, no findings with a confirmed known exploit have been ingested yet — the query is schema-valid and will return data once such findings appear.

Newly detected critical vulnerabilities

Monitor for new critical findings:

FROM Vulnerability
SELECT cve, package, package.version, entityLookupValue, firstDetected
WHERE severity = 'CRITICAL'
SINCE 30 days ago

Vulnerabilities requiring immediate attention

Combine multiple risk factors:

FROM Vulnerability
SELECT count(*) AS 'Findings', max(numeric(cvss.score)) AS 'Max CVSS', max(numeric(epss.percentile)) AS 'Max EPSS'
WHERE (severity = 'CRITICAL' AND numeric(epss.percentile) > 0.85)
   OR exploitKnown = 'true'
   OR numeric(epss.percentile) > 0.95
FACET cve, entityLookupValue, package
SINCE 30 days ago

Exposure and remediation tracking

Caution

The Vulnerability event does not include a resolvedAt field or a state (OPEN/CLOSED) lifecycle field. Queries for mean time to remediate (MTTR), remediation velocity, and critical vulnerability response time cannot be computed from this event as currently ingested. To track remediation metrics, use a separate data source such as issue or ticket-tracking data.

Longest-running open vulnerabilities

Find vulnerabilities that have been detected for extended periods:

FROM Vulnerability
SELECT min(firstDetected) AS 'First Detected', count(*) AS 'Occurrences'
FACET cve, entityLookupValue, package
LIMIT 20
SINCE 90 days ago

Vulnerabilities by age bucket

Group vulnerabilities by detection period:

FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
TIMESERIES 1 week
SINCE 180 days ago

Package and library analysis

Most vulnerable libraries

Identify libraries introducing the most vulnerabilities:

FROM Vulnerability
SELECT count(*) AS 'Vulnerability Count'
FACET package
LIMIT 10
SINCE 7 days ago

Libraries requiring upgrades

Find packages with available fixes:

FROM Vulnerability
SELECT count(*) AS 'Vulnerable Entities'
WHERE remediation.exists = 'true'
FACET package, package.version
LIMIT 20
SINCE 7 days ago

Vulnerability detection by source

Understand which integrations are finding vulnerabilities:

FROM Vulnerability
SELECT count(*) AS 'Detections'
FACET source
SINCE 30 days ago

Java dependencies analysis

Focus on Java-specific vulnerabilities:

FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
WHERE package LIKE '%.jar' OR package LIKE '%maven%' OR package.language = 'java'
FACET package, severity
SINCE 30 days ago
LIMIT 20

Entity-specific queries

Application vulnerability summary

Get vulnerability counts for a specific application:

FROM Vulnerability
SELECT count(*) AS 'Total',
       filter(count(*), WHERE severity = 'CRITICAL') AS 'Critical',
       filter(count(*), WHERE severity = 'HIGH') AS 'High',
       filter(count(*), WHERE severity = 'MEDIUM') AS 'Medium',
       filter(count(*), WHERE severity = 'LOW') AS 'Low'
WHERE entityLookupValue = 'YOUR_ENTITY_NAME'
SINCE 7 days ago

Vulnerability breakdown by entity type

Analyze vulnerabilities across different entity types:

FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
FACET entityLookupValue, severity, entityType
LIMIT 20
SINCE 7 days ago

Entities with no recent scans

Identify entities that may not be reporting vulnerability data:

FROM Vulnerability
SELECT max(timestamp) AS 'Last Scan'
FACET entityLookupValue
SINCE 30 days ago
LIMIT 20

Compliance and reporting

Vulnerabilities older than 30 days (SLA tracking)

Monitor vulnerabilities exceeding your remediation SLA:

FROM Vulnerability
SELECT count(*) AS 'Overdue Vulnerabilities'
FACET entityLookupValue, severity
SINCE 180 days ago
UNTIL 30 days ago
LIMIT 20

Monthly vulnerability metrics

Generate monthly reports:

FROM Vulnerability
SELECT count(*) AS 'Total Detected',
       uniqueCount(entityGuid) AS 'Affected Entities',
       filter(count(*), WHERE severity IN ('CRITICAL', 'HIGH')) AS 'High Risk'
FACET monthOf(firstDetected)
SINCE 180 days ago
TIMESERIES 1 month

Advanced analysis

Vulnerability blast radius

Identify vulnerabilities affecting many entities:

FROM Vulnerability
SELECT count(entityGuid) AS 'Affected Entities', max(numeric(cvss.score)) AS 'CVSS'
FACET cve
LIMIT 20
SINCE 30 days ago

Security hygiene score

Calculate a custom security score:

FROM Vulnerability
SELECT 100 - (
  filter(count(*), WHERE severity = 'CRITICAL') * 10 +
  filter(count(*), WHERE severity = 'HIGH') * 5 +
  filter(count(*), WHERE severity = 'MEDIUM') * 2 +
  filter(count(*), WHERE severity = 'LOW') * 0.5
) AS 'Security Score'
FACET entityLookupValue
SINCE 7 days ago
LIMIT 20

Vulnerability trends by type

Compare application vs infrastructure vulnerabilities:

FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
FACET entityType
TIMESERIES AUTO
SINCE 30 days ago

Entity-based security findings

Query current-state vulnerability data using the Entity event type. This approach is better suited for entity-centric questions than for timeseries trending:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING' AND cve.id IS NOT NULL
FACET cve.id, severity
SINCE 7 days ago

Tip

Adding AND cve.id IS NOT NULL filters out misconfiguration and policy-type findings that have no CVE mapped, which would otherwise dominate the facet results. This query uses the Entity event type (NerdGraph entity search) rather than the Vulnerability event type — it reflects current entity state rather than an event stream, so it is not suited for TIMESERIES trending.

Using these queries

In the query builder

Go to one.newrelic.com > All capabilities > Query your data
Copy and paste any query from this page
Click Run to see results
Adjust time ranges and filters as needed

In custom dashboards

Create a new dashboard or edit an existing one
Add a widget and select Query builder
Paste the query and configure visualization
Save the widget to your dashboard

In alerts

Go to Alerts > Create a condition
Select NRQL query as the condition type
Use queries that return counts or thresholds
Configure alert thresholds and notification channels

For more information on alerting, see Set up vulnerability alerts.

Tips for customizing queries

Replace placeholders

'YOUR_ENTITY_NAME' - Replace with your actual entity name from the entityLookupValue attribute
Time ranges (e.g., SINCE 30 days ago) - Adjust to your needs

Combine with other data

NRQL does not support cross-event JOINs. To correlate vulnerability data with APM or Infrastructure metrics, use separate queries and combine the results in a dashboard. For example:

-- Vulnerability data
FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
FACET entityLookupValue
SINCE 1 day ago

-- APM transaction data (run as a separate query)
FROM Transaction
SELECT average(duration) AS 'Avg Response Time'
FACET appName
SINCE 1 day ago

Export results

All query results can be:

Downloaded as CSV
Added to dashboards
Exported via API
Shared with your team

What's next?

Data structure reference

Learn about event types and attributes in detail

Set up alerts

Create alerts based on these queries

NRQL documentation

Learn more about NRQL syntax