author: David Dorsey, Splunk
date: '2017-09-10'
description: This search will show you any vulnerabilities noted for a specific endpoint
  for the last week.
how_to_implement: You need to be ingesting the logs from your vulnerability scanner.
id: df7a7f50-30f2-4cde-8448-69d2d5f9b3c5
inputs:
- dest
name: Get Vulnerability Logs For Endpoint
search: '| from datamodel Vulnerabilities.Vulnerabilities | search dest=$dest$'
tags:
  analytic_story:
  - ColdRoot MacOS RAT
  - DHS Report TA18-074A
  - 'Emotet Malware  DHS Report TA18-201A '
  - Hidden Cobra Malware
  - JBoss Vulnerability
  - Monitor for Unauthorized Software
  - Ransomware
  - SamSam Ransomware
  - Windows Log Manipulation
  product:
  - Splunk Phantom
type: response
version: 1
