---
title: Security data query examples
source: https://docs.newrelic.com/docs/vulnerability-management/advanced/query-examples
---

This guide provides ready-to-use NRQL queries for common security monitoring and analysis scenarios. Copy these queries into the query builder or add them to custom dashboards to gain deeper insights into your vulnerability data.

For information about the underlying data structure, see [Security data structure reference](https://docs.newrelic.com/docs/vulnerability-management/advanced/data-structure).

> #### ⚠️ IMPORTANT
>
> These queries are written against the real `Vulnerability` event schema. Note the following schema limitations:
>
> -   The `Vulnerability` event has no `state` or lifecycle field — queries cannot filter by OPEN/CLOSED status.
> -   There is no `resolvedAt` field — MTTR and remediation velocity queries that require a resolved timestamp cannot be reproduced from this event.
> -   `cvss.score` and `epss.percentile` are stored as strings. Use `numeric()` to cast them before comparing or aggregating numerically.
> -   `ORDER BY numeric(...)` is not supported. Alias the cast in `SELECT` and use `LIMIT` to retrieve top results.
> -   `HAVING` on faceted aggregates is not supported. Use `LIMIT` to return top-N results instead.

## Executive reporting

### Total open vulnerabilities by severity

Get a high-level view of your vulnerability exposure:

```sql
FROM Vulnerability
SELECT count(*) AS 'Total Vulnerabilities'
FACET severity
SINCE 7 days ago
```

### Critical and high severity trends

Track how critical vulnerabilities change over time:

```sql
FROM Vulnerability
SELECT count(*) AS 'Critical & High Vulnerabilities'
WHERE severity IN ('CRITICAL', 'HIGH')
TIMESERIES AUTO
SINCE 7 days ago
```

### Vulnerabilities by entity

Identify which applications or hosts have the most vulnerabilities:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerability Count'
FACET entityLookupValue
LIMIT 20
SINCE 7 days ago
```

### Vulnerability distribution across portfolio

Understand the spread of vulnerabilities:

```sql
FROM Vulnerability
SELECT percentage(count(*), WHERE severity = 'CRITICAL') AS 'Critical %',
       percentage(count(*), WHERE severity = 'HIGH') AS 'High %',
       percentage(count(*), WHERE severity = 'MEDIUM') AS 'Medium %',
       percentage(count(*), WHERE severity = 'LOW') AS 'Low %'
SINCE 7 days ago
```

## Prioritization and risk assessment

### High-priority vulnerabilities

Find vulnerabilities with high exploit probability:

```sql
FROM Vulnerability
SELECT cve, package, package.version,
       numeric(cvss.score) AS 'cvssScore',
       numeric(epss.percentile) AS 'epssPercentile'
WHERE numeric(epss.percentile) > 0.9
SINCE 30 days ago
LIMIT 20
```

### High-exploitability vulnerabilities

Identify vulnerabilities with a known exploit:

```sql
FROM Vulnerability
SELECT count(*) AS 'Findings', max(numeric(cvss.score)) AS 'Max CVSS'
WHERE exploitKnown = 'true'
FACET cve, entityLookupValue, package
SINCE 30 days ago
```

> #### 💡 TIP
>
> The `Vulnerability` event does not have an `activeRansomware` field. This query uses `exploitKnown` as the closest available indicator for high-risk findings. If this query returns no results, no findings with a confirmed known exploit have been ingested yet — the query is schema-valid and will return data once such findings appear.

### Newly detected critical vulnerabilities

Monitor for new critical findings:

```sql
FROM Vulnerability
SELECT cve, package, package.version, entityLookupValue, firstDetected
WHERE severity = 'CRITICAL'
SINCE 30 days ago
```

### Vulnerabilities requiring immediate attention

Combine multiple risk factors:

```sql
FROM Vulnerability
SELECT count(*) AS 'Findings', max(numeric(cvss.score)) AS 'Max CVSS', max(numeric(epss.percentile)) AS 'Max EPSS'
WHERE (severity = 'CRITICAL' AND numeric(epss.percentile) > 0.85)
   OR exploitKnown = 'true'
   OR numeric(epss.percentile) > 0.95
FACET cve, entityLookupValue, package
SINCE 30 days ago
```

## Exposure and remediation tracking

> #### ⚠️ CAUTION
>
> The `Vulnerability` event does not include a `resolvedAt` field or a `state` (OPEN/CLOSED) lifecycle field. Queries for mean time to remediate (MTTR), remediation velocity, and critical vulnerability response time cannot be computed from this event as currently ingested. To track remediation metrics, use a separate data source such as issue or ticket-tracking data.

### Longest-running open vulnerabilities

Find vulnerabilities that have been detected for extended periods:

```sql
FROM Vulnerability
SELECT min(firstDetected) AS 'First Detected', count(*) AS 'Occurrences'
FACET cve, entityLookupValue, package
LIMIT 20
SINCE 90 days ago
```

### Vulnerabilities by age bucket

Group vulnerabilities by detection period:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
TIMESERIES 1 week
SINCE 180 days ago
```

## Package and library analysis

### Most vulnerable libraries

Identify libraries introducing the most vulnerabilities:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerability Count'
FACET package
LIMIT 10
SINCE 7 days ago
```

### Libraries requiring upgrades

Find packages with available fixes:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerable Entities'
WHERE remediation.exists = 'true'
FACET package, package.version
LIMIT 20
SINCE 7 days ago
```

### Vulnerability detection by source

Understand which integrations are finding vulnerabilities:

```sql
FROM Vulnerability
SELECT count(*) AS 'Detections'
FACET source
SINCE 30 days ago
```

### Java dependencies analysis

Focus on Java-specific vulnerabilities:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
WHERE package LIKE '%.jar' OR package LIKE '%maven%' OR package.language = 'java'
FACET package, severity
SINCE 30 days ago
LIMIT 20
```

## Entity-specific queries

### Application vulnerability summary

Get vulnerability counts for a specific application:

```sql
FROM Vulnerability
SELECT count(*) AS 'Total',
       filter(count(*), WHERE severity = 'CRITICAL') AS 'Critical',
       filter(count(*), WHERE severity = 'HIGH') AS 'High',
       filter(count(*), WHERE severity = 'MEDIUM') AS 'Medium',
       filter(count(*), WHERE severity = 'LOW') AS 'Low'
WHERE entityLookupValue = 'YOUR_ENTITY_NAME'
SINCE 7 days ago
```

### Vulnerability breakdown by entity type

Analyze vulnerabilities across different entity types:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
FACET entityLookupValue, severity, entityType
LIMIT 20
SINCE 7 days ago
```

### Entities with no recent scans

Identify entities that may not be reporting vulnerability data:

```sql
FROM Vulnerability
SELECT max(timestamp) AS 'Last Scan'
FACET entityLookupValue
SINCE 30 days ago
LIMIT 20
```

## Compliance and reporting

### Vulnerabilities older than 30 days (SLA tracking)

Monitor vulnerabilities exceeding your remediation SLA:

```sql
FROM Vulnerability
SELECT count(*) AS 'Overdue Vulnerabilities'
FACET entityLookupValue, severity
SINCE 180 days ago
UNTIL 30 days ago
LIMIT 20
```

### Monthly vulnerability metrics

Generate monthly reports:

```sql
FROM Vulnerability
SELECT count(*) AS 'Total Detected',
       uniqueCount(entityGuid) AS 'Affected Entities',
       filter(count(*), WHERE severity IN ('CRITICAL', 'HIGH')) AS 'High Risk'
FACET monthOf(firstDetected)
SINCE 180 days ago
TIMESERIES 1 month
```

## Advanced analysis

### Vulnerability blast radius

Identify vulnerabilities affecting many entities:

```sql
FROM Vulnerability
SELECT count(entityGuid) AS 'Affected Entities', max(numeric(cvss.score)) AS 'CVSS'
FACET cve
LIMIT 20
SINCE 30 days ago
```

### Security hygiene score

Calculate a custom security score:

```sql
FROM Vulnerability
SELECT 100 - (
  filter(count(*), WHERE severity = 'CRITICAL') * 10 +
  filter(count(*), WHERE severity = 'HIGH') * 5 +
  filter(count(*), WHERE severity = 'MEDIUM') * 2 +
  filter(count(*), WHERE severity = 'LOW') * 0.5
) AS 'Security Score'
FACET entityLookupValue
SINCE 7 days ago
LIMIT 20
```

### Vulnerability trends by type

Compare application vs infrastructure vulnerabilities:

```sql
FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
FACET entityType
TIMESERIES AUTO
SINCE 30 days ago
```

### Entity-based security findings

Query current-state vulnerability data using the `Entity` event type. This approach is better suited for entity-centric questions than for timeseries trending:

```sql
FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING' AND cve.id IS NOT NULL
FACET cve.id, severity
SINCE 7 days ago
```

> #### 💡 TIP
>
> Adding `AND cve.id IS NOT NULL` filters out misconfiguration and policy-type findings that have no CVE mapped, which would otherwise dominate the facet results. This query uses the `Entity` event type (NerdGraph entity search) rather than the `Vulnerability` event type — it reflects current entity state rather than an event stream, so it is not suited for `TIMESERIES` trending.

## Using these queries

### In the query builder

1.  Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Query your data**
2.  Copy and paste any query from this page
3.  Click **Run** to see results
4.  Adjust time ranges and filters as needed

### In custom dashboards

1.  Create a new dashboard or edit an existing one
2.  Add a widget and select **Query builder**
3.  Paste the query and configure visualization
4.  Save the widget to your dashboard

### In alerts

1.  Go to **Alerts > Create a condition**
2.  Select **NRQL query** as the condition type
3.  Use queries that return counts or thresholds
4.  Configure alert thresholds and notification channels

For more information on alerting, see [Set up vulnerability alerts](https://docs.newrelic.com/docs/vulnerability-management/advanced/set-up-alerts).

## Tips for customizing queries

### Replace placeholders

-   `'YOUR_ENTITY_NAME'` - Replace with your actual entity name from the `entityLookupValue` attribute
-   Time ranges (e.g., `SINCE 30 days ago`) - Adjust to your needs

### Combine with other data

NRQL does not support cross-event JOINs. To correlate vulnerability data with APM or Infrastructure metrics, use separate queries and combine the results in a dashboard. For example:

```sql
-- Vulnerability data
FROM Vulnerability
SELECT count(*) AS 'Vulnerabilities'
FACET entityLookupValue
SINCE 1 day ago
```

```sql
-- APM transaction data (run as a separate query)
FROM Transaction
SELECT average(duration) AS 'Avg Response Time'
FACET appName
SINCE 1 day ago
```

### Export results

All query results can be:

-   Downloaded as CSV
-   Added to dashboards
-   Exported via API
-   Shared with your team

## What's next?

[Data structure reference](https://docs.newrelic.com/docs/vulnerability-management/advanced/data-structure)

Learn about event types and attributes in detail

[Set up alerts](https://docs.newrelic.com/docs/vulnerability-management/advanced/set-up-alerts)

Create alerts based on these queries

[NRQL documentation](https://docs.newrelic.com/docs/nrql/get-started/introduction-nrql-new-relics-query-language)

Learn more about NRQL syntax