Retrieve Critical Vulnerabilities

This article provides an example demonstrating how to query for critical vulnerabilities using the BQL API. While this example focuses on a specific set of attributes, you can tailor the query to include the attributes that fit your needs. For more details on the BQL API, see the BQL API documentation.

Start the query

Send a POST request to start the query. This example retrieves active, critical vulnerabilities with selected fields and a nested relationship projection for the vulnerability type, which includes CVE IDs.

curl -X POST 'https://<your-brinqa-instance>/v1/api/bql' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: ApiKey <your-api-token>' \
  -d '{
    "query": "FIND Vulnerability WHERE status = \"Active\" AND riskRating = \"Critical\"",
    "returningFields": ["id", "ageInDays", "complianceStatus", "connectorNames", "description", "riskScore", "type(cveIds, name, recommendation)"],
    "limit": 10
  }'

note

Replace <your-brinqa-instance> with the URL of your Brinqa Platform and <your-api-token> with your API token.

The API returns a 202 Accepted response with a Location header:

HTTP/2 202
Location: /v1/api/bql/eyJqb2JI...
Retry-After: 2

Fetch results

Use the Location value from the previous response to poll for results:

curl 'https://<your-brinqa-instance>/v1/api/bql/eyJqb2JI...' \
  -H 'Authorization: ApiKey <your-api-token>'

If the query is still processing, the response has status "processing". Poll again after the number of seconds indicated in the Retry-After header. When the query completes, the response contains the matching vulnerabilities. Note how the type relationship is returned as a nested object with the requested fields:

{
  "status": "completed",
  "state": "success",
  "message": "Query completed successfully.",
  "results": [
    {
      "id": 1688658462584209423,
      "ageInDays": 2580,
      "complianceStatus": "Out of SLA",
      "connectorNames": ["Qualys Vulnerability Management"],
      "description": "Several vulnerabilities have been reported in PHP.",
      "riskScore": 9,
      "type": {
        "cveIds": ["CVE-2007-0905", "CVE-2007-0906"],
        "name": "PHP Prior to 5.2.1/4.4.5 Multiple Vulnerabilities",
        "recommendation": "Upgrade to the latest version of PHP."
      }
    },
    {
      "id": 1688658462600986646,
      "ageInDays": 2826,
      "complianceStatus": "Out of SLA",
      "connectorNames": ["Qualys Vulnerability Management"],
      "description": "The rpc.statd program has a format string vulnerability.",
      "riskScore": 9,
      "type": {
        "cveIds": ["CVE-2000-0666", "CVE-2000-0800"],
        "name": "Statd Format Bug Vulnerability",
        "recommendation": "For Red Hat Linux, apply the latest security patches."
      }
    }
  ],
  "totalRows": 2,
  "pageRows": 2,
  "cursor": null
}