id: vulnerability_mediumlow
version: 1
meta:
  name: Multiple MEDIUM or LOW-rated vulnerabilities were found
  description: >
    Multiple vulnerabilities rated as MEDIUM or LOW were found on a host.

    Such vulnerabilities pose a lower risk to the target, however in
    aggregate may be an indication that the host is not well maintained.
  risk: MEDIUM
collections:
  - collect:
      - method: exact
        field: type
        value:
          - VULNERABILITY_CVE_MEDIUM
          - VULNERABILITY_CVE_LOW
          - VULNERABILITY_GENERAL
aggregation:
  field: entity.data
analysis:
  - method: threshold
    field: entity.data
    minimum: 2
headline: "Multiple medium/low vulnerabilities found on {entity.data}"