I'm trying to create a widget that tells me how many vulnerabilities have been fixed within the last 30 days for a particular group of assets. I'm using vulnerabilities.status:FIXED to identify the status and vulnerabilities.lastFound to keep within 30 days but the results are not accurate when compared with other information. Also, there seems to be different ways of determining the age, for example: now-30d or now-30d..now-1s and they seem to produce different results as well.
Can anyone tell me what is the definition of lastFound when used alongside status.FIXED? Does it mean the last time the vulnerability was found in the FIXED state or just the last time the vulnerability was detected? If it's the former, would it be better to use firstFound?