Absent Member.
Absent Member.

Calculating an average in a report

Dear Community,

I'm fairly new to ArcSight ESM, and I've been tasked with the following:

We use Tenable Nessus for vulnerability scanning, and the connector works quite well. ArcSight console shows every single scan result (this could be many per scanned host) as one single event. For our management, I am to produce  report of how many vulnerabilities per priority per host we have on average.

I have managed to get a report that shows me the absolute number of vulnerabilities per priority.

Currently I am stuck at the point of calculating the average. Can this be done in ArcSight and if so, how?

Thanks in advance

Labels (2)
Tags (3)
3 Replies
Fleet Admiral
Fleet Admiral

Hai Volker Tanner,

1.Did u Check out with Custom Variables where u can Create the Average Function Variable...

2. If U are Creating a Report then u can add the Average Function Feature to Specific Cloumn by Template Designer.

    I have Attached the Image in that u can see where Average Function can be Added to Specific Columns through Scripts.

I Hope it is Helpful. Please Revert in case If u want that Average Field for Viewing in Console itself.

Absent Member.
Absent Member.

You can do it through 1 trend and 1 AL.

First create a trend with: Host Info, Priority, Vulnerability Count fields. Then in the trend action, write to an AL.

Your final report would be on that AL, there you can just group by Priority and take average on

Vulnerability Count.

It's important that the Vulnerability Count is the count of all vulnerabilities reported per (Host, Priority) tuple.


Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Why do you need an active list ? A trend + a query on this trend should be enough

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.