mysql - 单独运行查询时返回结果，将其添加到更大的查询时返回不明确的引用

Question

我正在尝试编写一个查询，按主机名汇总漏洞，并包含有关该主机的信息。查询正在 Rapid7 InsightVM 中运行

返回 Assets 信息的查询成功运行，但当我附加该查询以返回漏洞信息时，它会返回一个不明确的描述引用错误。但 ip 地址、host_name 和 asset_id 值返回得很好。

我只是想将它们组合在一起以返回该信息。我觉得缺少一些明显的东西。

这会从 Assets 表中返回我想要的内容，包括操作系统描述(Windows、RHEL 等):

SELECT da.asset_id, da.host_name, da.ip_address, dos.description
FROM dim_asset da
JOIN dim_operating_system dos ON dos.operating_system_id = da.operating_system_id
JOIN fact_asset fa ON fa.asset_id = da.asset_id
GROUP BY da.asset_id, da.host_name, da.ip_address, dos.description

这会返回一个不明确的描述引用，它适用于 asset_id、host_name 和 ip_address:

    WITH remediations AS (
        SELECT DISTINCT fr.solution_id AS ultimate_soln_id, summary, fix, estimate, riskscore, dshs.solution_id AS solution_id
        FROM fact_remediation(10,'riskscore DESC') fr
        JOIN dim_solution ds USING (solution_id)
        JOIN dim_solution_highest_supercedence dshs ON (fr.solution_id = dshs.superceding_solution_id AND ds.solution_id = dshs.superceding_solution_id)

    ),

    assets AS (
        SELECT da.asset_id, da.host_name, da.ip_address, dos.description
        FROM dim_asset da
        JOIN dim_operating_system dos ON dos.operating_system_id = da.operating_system_id
        JOIN fact_asset fa ON fa.asset_id = da.asset_id
        GROUP BY da.asset_id, da.host_name, da.ip_address, dos.description
    )

    SELECT
       csv(DISTINCT dv.title) AS "Vulnerability Title",
       host_name AS "Asset Hostname", ip_address AS "Asset IP", description AS "OS",
       round(sum(dv.riskscore)) AS "Asset Risk",
       summary AS "Solution",
       fix as "Fix"

    FROM remediations r
       JOIN dim_asset_vulnerability_solution dvs USING (solution_id)
       JOIN dim_vulnerability dv USING (vulnerability_id)
       JOIN assets USING (asset_id)

    GROUP BY r.riskscore, host_name, ip_address, asset_id, summary, fix
    ORDER BY "Asset Risk" DESC     WITH remediations AS (

Answer 1

很可能，dim_asset_vulnerability_solution 或 dim_vulnerability 也有一个description 字段。只需使用预期来源限定所选字段即可解决此问题。

...
a.host_name AS "Asset Hostname", a.ip_address AS "Asset IP", a.description AS "OS"
...
JOIN assets AS a USING (asset_id)
...
GROUP BY r.riskscore, a.host_name, a.ip_address, asset_id, summary, fix

注意:asset_id 不是问题，因为 USING 有一些额外的“魔法”，可以合并由它连接的引用。

注释:除非有非常具体的原因，否则 GROUP BY 不应用作 SELECT DISTINCT 的替代品(特别指的是 Assets CTE)