Security data structure (NRQL reference)

Security RX stores vulnerability and misconfiguration data in New Relic's database (NRDB), making it queryable using NRQL. This reference guide explains the entity types, attributes, and data structure you can use to build custom queries, dashboards, and alerts.

Entity and event types

Security RX uses the following entity and event types to store security data:

SecurityFinding Entity (Recommended)

The SECURITY_FINDING is a specialized entity type that serves as a generic container for all security issues detected by Security RX. This is the recommended way to query security data in New Relic.

Important: SecurityFinding is queried as an Entity type, not as a traditional event:

FROM Entity
SELECT * WHERE type = 'SECURITY_FINDING'

Understanding findingType

The findingType attribute is the key field for distinguishing the data source:

• findingType = 'VULNERABILITY': Indicates a vulnerability finding from sources like APM agents, Infrastructure agents, or third-party scanners (Snyk, Trivy, FOSSA)
• findingType = 'MISCONFIGURATION': Indicates a cloud security posture management (CSPM) finding from Security RX Cloud (e.g., from AWS Security Hub, GuardDuty, or Config)

Other findingType values include: LIBRARY_VULNERABILITY, INFRASTRUCTURE_VULNERABILITY, APPLICATION_VULNERABILITY, SYSTEM_VULNERABILITY, SECURITY_EVENT, and OTHER.

Core entity fields

Classification fields

Status and severity fields

CVE reference fields

For vulnerability findings, the cve object contains detailed CVE information:

Misconfiguration fields (Cloud findings)

For misconfiguration findings, the misconfiguration object contains cloud-specific information:

Impacted entity fields

The impactedEntity object identifies which New Relic entity is affected:

Timestamp fields

UI and internal fields

Query examples for vulnerabilities

Count active critical vulnerabilities by entity:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND status = 'AFFECTED'
  AND severity = 'CRITICAL'
FACET impactedEntity.name

Find entities affected by a specific CVE:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND status = 'AFFECTED'
  AND cve.id = 'CVE-2024-23944'
FACET impactedEntity.name

Find CVEs with active ransomware campaigns:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND cve.exploitKnown IS true
FACET impactedEntity.name, cve.id

Find likely exploitable vulnerabilities (high EPSS score):

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND cve.epssPercentile > '0.95'
FACET cve.id

Find reporting sources for your findings:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
FACET source

Entities with high vulnerability thresholds:

SELECT impactedEntity
FROM (
  SELECT count(*) AS vulnerableCount
  FROM Entity
  WHERE type = 'SECURITY_FINDING'
    AND severity IN ('CRITICAL', 'HIGH')
  FACET impactedEntity.name AS impactedEntity, severity
)
WHERE (severity = 'HIGH' AND vulnerableCount > 10)
   OR (severity = 'CRITICAL' AND vulnerableCount > 5)

Query examples for cloud misconfigurations

Count unique misconfigurations by status:

FROM Entity
SELECT uniqueCount(misconfiguration.issueTitle)
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'MISCONFIGURATION'
FACET status

Top 10 most common misconfiguration types:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'MISCONFIGURATION'
  AND internalState.active = true
FACET misconfiguration.issueTitle
LIMIT 10

Find riskiest AWS accounts:

FROM Entity
SELECT uniqueCount(misconfiguration.issueTitle)
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'MISCONFIGURATION'
  AND internalState.active = true
  AND severity IN ('CRITICAL', 'HIGH')
FACET aparse(additionalInfo, '%"key":"cloudProviderAccountId","values":["*"]%') AS 'AWS Account ID'
LIMIT 10

Count misconfigurations by resource type:

FROM Entity
SELECT uniqueCount(misconfiguration.issueTitle)
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'MISCONFIGURATION'
  AND internalState.active = true
FACET misconfiguration.normalizedResourceType

Find critical and publicly exposed resources:

FROM Entity
SELECT name, impactedEntity.name, misconfiguration.misconfigurationType
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'MISCONFIGURATION'
  AND internalState.active = true
  AND severity = 'CRITICAL'
  AND misconfiguration.misconfigurationType LIKE 'Effects/Data Exposure'
SINCE 1 day ago

Vulnerability (Custom Event)

Stores detailed vulnerability metadata including CVE information, severity scores, and remediation guidance.

Primary use: Deep dive into vulnerability details and metadata

Key attributes:

Query example:

FROM Vulnerability
SELECT count(*)
WHERE severity = 'CRITICAL'
AND activeRansomware = true
FACET affectedPackage

Common attributes across event types

These attributes appear across multiple event types:

Entity identification

Timestamps

Source tracking

Data relationships

Understanding how data types relate to each other:

SecurityFinding Entity (type = 'SECURITY_FINDING')
    ↓ contains
    ├─ findingType (VULNERABILITY or MISCONFIGURATION)
    ├─ cve (CVE details for vulnerabilities)
    ├─ misconfiguration (Cloud security details)
    └─ impactedEntity (Affected New Relic entity)

Query patterns

For query patterns using SecurityFinding Entity, see the Query examples sections above.

Attribute types and formats

Severity values

CRITICAL - CVSS 9.0-10.0
HIGH     - CVSS 7.0-8.9
MEDIUM   - CVSS 4.0-6.9
LOW      - CVSS 0.1-3.9
INFO     - CVSS 0.0

State values

OPEN      - Vulnerability currently active
CLOSED    - Vulnerability resolved or fixed
AFFECTED  - Entity is confirmed affected
IGNORED   - Marked as not applicable
NO_LONGER_DETECTED - No longer seen in scans

Source values

APM_AGENT            - Detected by New Relic APM agent
INFRASTRUCTURE       - Detected by Infrastructure agent
SNYK                 - Imported from Snyk
AWS_SECURITY_HUB     - Imported from AWS Security Hub
DEPENDABOT           - Imported from GitHub Dependabot
FOSSA                - Imported from FOSSA
TRIVY                - Imported from Trivy
SECURITY_DATA_API    - Sent via API

Querying tips

Filter by severity (Modern approach)

Findings are prioritized based on severity:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND severity IN ('CRITICAL', 'HIGH')
  AND status = 'AFFECTED'
FACET impactedEntity.name

Filter by finding type

Separate vulnerabilities from misconfigurations:

-- Vulnerabilities only
FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'VULNERABILITY'
FACET impactedEntity.type

-- Misconfigurations only
FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND findingType = 'MISCONFIGURATION'
FACET misconfiguration.normalizedResourceType

Filter by entity type

Separate application from infrastructure vulnerabilities:

-- Application vulnerabilities
FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND impactedEntity.type LIKE '%APPLICATION%'
FACET impactedEntity.name

-- Infrastructure vulnerabilities
FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND impactedEntity.type LIKE '%HOST%'
FACET impactedEntity.name

Filter by detection source

Query findings from specific integrations:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND source = 'Snyk'
FACET severity

Time-based filtering

Find recently detected findings:

FROM Entity
SELECT count(*)
WHERE type = 'SECURITY_FINDING'
  AND firstDetected > ago(7 days)
FACET cve.id, severity

Building custom dashboards

Use SecurityFinding Entity to create comprehensive security dashboards:

1. Executive dashboard - High-level security metrics across all finding types

   FROM Entity
   SELECT count(*)
   WHERE type = 'SECURITY_FINDING'
     AND status = 'AFFECTED'
   FACET severity, findingType

   Copier

2. Vulnerability trends - Track vulnerability detection over time

   FROM Entity
   SELECT count(*)
   WHERE type = 'SECURITY_FINDING'
     AND findingType = 'VULNERABILITY'
   FACET weekOf(firstDetected)
   SINCE 90 days ago

   Copier

3. Cloud security posture - Monitor cloud misconfigurations

   FROM Entity
   SELECT uniqueCount(misconfiguration.issueTitle)
   WHERE type = 'SECURITY_FINDING'
     AND findingType = 'MISCONFIGURATION'
   FACET misconfiguration.cloudProvider, severity

   Copier

4. Entity security posture - Per-entity security views

   FROM Entity
   SELECT count(*) AS 'Findings'
   WHERE type = 'SECURITY_FINDING'
     AND status = 'AFFECTED'
   FACET impactedEntity.name, severity

   Copier

For more query examples, see Security data query examples.

Legacy dashboard approaches

For backward compatibility, you can still use the legacy event type (Vulnerability), but we recommend migrating to SecurityFinding Entity for new dashboards.

What's next?