I cant seem to get this query to return any results:
vulnerabilities.vulnerability.published: [now-1m ... now-1s]
I've tried adjusting the 1M part to to 3M even as far as 6M. but it comes back with no results. I've also tried this:
which i think would only show vulnerabilities published 6 months ago exactly... but it throws an error at any rate.
I'm trying to create a widget that shows me the number of machines that need patches that are 1-30 days old, 30-60 days old and any patches older than 90 days. I feel like the query for 30 days old should look something like this:
vulnerabilities.vulnerability.patchAvailable:"true" and vulnerabilities.vulnerability.published: [2016-01-01 ... now-1M]
but again, i don't have any results show up... anyone have any suggestions??