How to Search in Certificate View

Search by Field

Enter the field name, then a colon, then your query. Nested fields are dot separated.

Examples

certificate:(approved: true)
asset:(name: server1)

String Matching

Use single quotes or double quotes around your query to match a string. Your results will include any asset that contains the string.

Examples

asset:(operatingSystem: "NetScaler")
certificate:(issuerCategory: "DigiCert Test")

Exact Matching

Use backticks to exactly match a string. Your results will include any asset with the EXACT value returned.

Examples

instance:(grade: `T`)
certificate:(keySize: `4096`)

Full Text Search

Many asset fields containing text allow you to use full text search and advanced search capabilities.

Learn more >>

Examples

Show any findings related to this title

certificate:(subject.locality: Redwood City)

Show any findings that contain Redwood or City in title

certificate:(subject.locality: "Redwood City")

Show any findings that match exact value Redwood City

certificate:(subject.locality: `Redwood City`)

Show any findings that match nested query. Both sub fields must match in order for a certificate to be returned.

certificate:(expiryGroup: `In 90 Days` and signatureAlgorithm: "SHA256withRSA")

Suffix Matching

Suffix matching is supported when searching assets (on your Assets list) for the fields "name", "tags.name" and "netbiosName". Match asset values "ending in" a string you specify - using a string that starts with *. Matches are case insensitive.

Example: This query matches assets with an asset name ending in "slb.com" like onapsis-prd.amsterdam-nl0123.slb.com.

asset:(name:*slb.com)

Example: This query matches assets with tag names ending in "region east" like Region East, region east, Region EAST.

assets:(tags.name:*Region East)

Suffix matching is also supported for the field "assetinterfaces.hostname" but the syntax is different.

Example: These queries match assets with the hostname "T100.qualys.corp.com".

asset:(assetInterface.hostname:com)
asset:(assetInterface.hostname:corp.com)
asset:(assetInterface.hostname:qualys.corp.com)

Range Searches

Ranges can be specified with the [lower .. upper] syntax using () and/or [] as follows. This is supported for numeric and date fields.

Examples

Greater than or equal to 121 and less than or equal to 443 - uses square brackets

instance:(port:[121 .. 443])

Greater than but not equal to 121 and less than but not equal to 443 - uses parenthesis

instance:(port:(122 .. 443))

Greater than or equal to 121 and less than but not equal to 443

instance:(port:[121 ..443))

Greater than but not equal to 123 and less than or equal to 1234

instance:(port:(121 .. 443])

Greater than 443

instance:(port > 443)

Greater than or equal to 443

instance:(port >= 443)

Less than 443

instance:(port < 443)

Less than or equal to 443

instance:(port <= 443)

Between January 1st and April 1st 2021

certificate:(validFrom:[2021-01-01 .. 2021-04-01])

Date Searches

Use a date range [start date .. end date] or a specific date. Several date variables are also available.

Learn more >>

Examples

certificate:(expiryGroup: "In 20 Days")
certificate:(keySize < `4096`)
certificate:(validFrom: [2020-06-15 .. 2022-06-30])
certificate:(validTo: "[now..2022-12-01]")

Boolean Operators

Use keywords AND, OR, NOT to narrow or broaden your search.

Examples

certificate:(expiryGroup: In 30 Days) and certificate:(issuer.name: DigiCert)
asset:(operatingSystem: Windows) or asset:(operatingSystem: Netscaler)
not certificate:(issuer.organization: Qualys)

Nested Queries

Use a single nested query, using parentheses, to include multiple fields in your query per example below.

Example

Show the certificates issued by DigiCert with keysize 2048 and will expire in 30 days

certificate:(expiryGroup: In 30 Days and keySize: `2048`) and certificate:(issuer.name: DigiCert)