Use the search tokens below to search for containers. Looking for help with writing your query? click here
Example
Show containers run with this command argument
arguments: family
Example
Show containers deployed on a AWS EC2 instance with this instance ID.
cloudProvider.aws.ec2.instanceId:"i-0ab8d3318979f529c"
Example
Show AWS Fargate containers with this AWS ECS account ID
cloudProvider.aws.ecs.accountId: 123456789012
Example
Show AWS Fargate containers with this cluster name
cloudProvider.aws.ecs.clusterName: my-cluster
Example
Show AWS Fargate containers with this container ID
cloudProvider.aws.ecs.container.id: 1234bafa-d5ac-6789-0ae1-23b4d5f67baa
Example
Show AWS Fargate containers with this container MAC address
cloudProvider.aws.ecs.container.macAddress: 01:2d:a3:45:67:d8
Example
Show AWS Fargate containers with this container subnet ID
cloudProvider.aws.ecs.container.subnetId: subnet-0b12c3a456fdaab78
Example
Show AWS Fargate containers with this region code
cloudProvider.aws.ecs.region.code: us-west-2
Example
Show containers running on master node
cluster.k8s.node.isMaster: true
Example
Show containers with this node name
cluster.k8s.node.name: my-node
Example
Show containers with this pod controller name
cluster.k8s.pod.controller.name: my-controller
Example
Show containers with this pod controller type
cluster.k8s.pod.controller.type: ReplicationController
Example
Show containers with this pod controller uuid
cluster.k8s.pod.controller.uuid: 01234567-89ab-cdef-0123-456789abcdef
Example
Show containers with this pod label name
cluster.k8s.pod.label.key: environment
Example
Show containers with this pod label value
cluster.k8s.pod.label.value: production
Example
Show containers with this pod name
cluster.k8s.pod.name: my-pod
Example
Show containers with this pod namespace
cluster.k8s.pod.namespace: my.namespace.example.com
Example
Show containers within a namespace using these labels assigned to the namespace.
cluster.k8s.pod.namespaceMetadata.labels:"label1:value1"
Example
Show containers within a namespace using these annotations assigned to the namespace.
cluster.k8s.pod.namespaceMetadata.annotations:"annotation1:value1"
Example
Show containers with this pod uuid
cluster.k8s.pod.uuid: 01234567-89ab-cdef-0123-456789abcdef
Example
Show containers with this Kubernetes cluster project
cluster.k8s.project: my-project
Example
Show containers with the Kubernetes cluster type
cluster.type: KUBERNETES
Example
Show containers run with this command
command: /run.sh
Example
Show container with this ID
containerId: ed46df944e1c
Example
Show containers with this control ID
controls.controlId: 10826
Example
Show containers with URGENT controls
controls.criticality: "URGENT"
Example
Show containers with failed controls
controls.posture: "FAIL"
Examples
Find containers created within certain dates
created: [2017-06-15 ... 2017-06-30]
Find containers created on specific date
created:'2017-08-15'
Example
Show containers with this environment variable
environment: "my-variable"
Example
Show containers on which these exceptions are applied.
exceptions.name: [Exception1,Exception2]
Example
Show findings with arm64 host architecture
hostArchitecture: arm64
Example
Show containers with this hostname
host.hostname: dockerhost07.mydomain.com
Example
Show container with this IP address
host.ipAddress: 10.44.92.127
Example
Show containers with this image ID
imageId: c2d1b73a90ec
Example
Show container image with this SHA value
imageSha: 163dc7f6b91a30bdaa867c28e7edc341e72da63b0f9056be497bd59a83bce695
Example
Show containers on this IPv4 address
ipv4: 172.17.0.2
Example
Show containers on this IPv6 address
ipv6: fe80:0:0:0:2502:b53c:4139:404b
Example
Show containers spun from instrumented images
isInstrumented: true
Example
Show drift containers
isDrift: true
Example
Show containers running processes as root
isRoot: true
Example
Show containers with drift software
drift.category: Software
Example
Show drift reason
drift.reason: Fixed
Example
Show containers with label name "vendor"
label.key: vendor
Example
Show containers with label value "CentOS"
label.value: CentOS
Examples
Show containers with last compliance scan within certain dates
lastComplianceScanDate: [2021-01-01 ... 2021-01-30]
Show containers with last compliance scan starting 2020-10-15, ending 1 month ago
lastComplianceScanDate: [2020-10-15 ... now-1M]
Show containers with last compliance scan starting 2 weeks ago, ending 1 second ago
lastComplianceScanDate: [now-2w ... now-1s]
Show containers with last compliance scan on specific date
lastComplianceScanDate:'2021-01-18'
Examples
Show containers last scanned within certain dates
lastVmScanDate: [2021-01-01 ... 2021-01-30]
Show containers last scanned starting 2020-10-15, ending 1 month ago
lastVmScanDate: [2020-10-15 ... now-1M]
Show containers last scanned starting 2 weeks ago, ending 1 second ago
lastVmScanDate: [now-2w ... now-1s]
Show containers last scanned on specific date
lastVmScanDate:'2021-01-18'
Example
Show container with this MAC address
macAddress: 00-50-56-A9-73-5A
Example
Show this container name
name: my-container
Example
Show containers installed at this path
path: "/usr/path/container/"
Example
Show containers with this host mapping host IP
portMapping.hostIp: xxx.xxx.xxx.xxx
Example
Show containers with this host mapping host port
portMapping.hostPort: xxxxx
Example
Show containers with this port mapping port
portMapping.port: xxxxx
Example
Show containers with this port mapping protocol
portMapping.protocol: UDP
Example
Show containers whose privilege status is true
privileged: true
Example
Show findings with software name
drift.software.name: my-app
Example
Show findings with software version
drift.software.version: 8.0
Example
Show findings with certain fix version
drift.software.fixVersion: 8.0
Example
Show findings with Windows auth type
drift.software.vulnerabilities.authType: "WINDOWS_AUTH"
Example
Show findings with category CGI
drift.software.vulnerabilities.category: "CGI"
Examples
Show findings with customer-defined severity 4
drift.software.vulnerabilities.customerSeverity: "4"
Show findings with customer-defined severity 5 and category DNS
drift.software.vulnerabilities: (customerSeverity: "5" AND category: "DNS")
Example
Show findings with CVE Ids
drift.software.vulnerabilities.cveids: "CVE-2014-9999"
Example
Show findings with CVSS access vector
drift.software.vulnerabilities.cvssInfo.accessVector: "Local"
Example
Show findings with CVSS base score
drift.software.vulnerabilities.cvssInfo.baseScore: "7.2"
Example
Show findings with CVSS temporal score
drift.software.vulnerabilities.cvssInfo.temporalScore: "6.2"
Example
Show findings with CVSS3 base score
drift.software.vulnerabilities.cvss3Info.baseScore: "4.3"
Example
Show findings with CVSS3 temporal score
drift.software.vulnerabilities.cvss3Info.temporalScore: "3.8"
Example
Show findings with Remote discovery type
drift.software.vulnerabilities.discoveryType: "REMOTE"
Examples
Show findings first found within certain dates
drift.software.vulnerabilities.firstFound: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
drift.software.vulnerabilities.firstFound: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
drift.software.vulnerabilities.firstFound: [now-2w ... now-1s]
Show findings first found on certain date
drift.software.vulnerabilities.firstFound:'2017-09-22'
Show findings first found in the past 10 days with severity 5
drift.software.vulnerabilities: (firstFound > now-10d AND severity: "5")
Examples
Show findings last found within certain dates
drift.software.vulnerabilities.lastFound: [2017-10-02 ... 2017-10-15]
Show findings last found starting 2017-10-01, ending 1 month ago
drift.software.vulnerabilities.lastFound: [2017-10-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
drift.software.vulnerabilities.lastFound: [now-2w ... now-1s]
Show findings last found on certain date
drift.software.vulnerabilities.lastFound:'2017-10-11'
Show findings last found on 2017-10-12 and category CGI
drift.software.vulnerabilities: (lastFound: '2017-10-12' AND category: "CGI")
Example
Show findings with libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4
drift.software.vulnerabilities.result: "libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4"
Example
Show findings with risk 50
drift.software.vulnerabilities.risk: 50
Examples
Show findings with severity 4
drift.software.vulnerabilities.severity: "4"
Show findings with severity 5 and category DNS
drift.software.vulnerabilities: (severity: "5" AND category: "DNS")
Example
Show findings supported by VM
drift.software.vulnerabilities.supportedBy: "VM"
Examples
Show findings exposed to public exploit threats
drift.software.vulnerabilities.threatIntel: "publicExploit": true
Show findings exposed to multiple threats
drift.software.vulnerabilities.threatIntel: {"publicExploit" : true, "publicExploitNames" : ["Sambar Server 4.3/4.4 Beta 3 - Search CGI - The Exploit-DB Ref : 20223" ]}
Example
Show findings with this detection type
drift.software.vulnerabilities.typeDetected: "CONFIRMED"
Example
Show findings with QID 90405
drift.software.vulnerabilities.qid: 90405
Example
Show findings with title
drift.software.vulnerabilities.title: title text
Example
Show findings with software name
drift.software.vulnerabilities.software.name: my-app
Example
Show findings with software version
drift.software.vulnerabilities.software.version: 8.0
Example
Show findings with certain fix version
drift.software.vulnerabilities.software.fixVersion: 8.0
Example
Show drift software from images
drift.software.vulnerabilities.source: IMAGE
Example
Show drift software that is new
drift.software.vulnerabilities.reason: NEW
Example
Show containers exposed to threats due to active attacks
drift.software.vulnerabilities.threatIntel.activeAttacks: true
Example
Show containers having threats due to denial of service
drift.software.vulnerabilities.threatIntel.denialOfService: true
Example
Show containers exposed to threats due to easy exploit
drift.software.vulnerabilities.threatIntel.easyExploit: true
Example
Show containers exposed to threats due to high data loss
drift.software.vulnerabilities.threatIntel.highDataLoss: true
Example
Show containers exposed to threats due to high lateral movement
drift.software.vulnerabilities.threatIntel.highLateralMovement: true
Example
Show containers exposed to threats due to malware
drift.software.vulnerabilities.threatIntel.malware: true
Example
Show containers exposed to threats due to no patch available
drift.software.vulnerabilities.threatIntel.noPatch: true
Example
Show containers exposed to threats due to public exploit
drift.software.vulnerabilities.threatIntel.publicExploit: true
Example
Show drift software from images
drift.software.source: IMAGE
Example
Show drift software that is new
drift.software.reason: NEW
Example
Show findings with Windows auth type
drift.vulnerability.authType: "WINDOWS_AUTH"
Example
Show findings with category CGI
drift.vulnerability.category: "CGI"
Examples
Show findings with customer-defined severity 4
drift.vulnerability.customerSeverity: "4"
Show findings with customer-defined severity 5 and category DNS
drift.vulnerability: (customerSeverity: "5" AND category: "DNS")
Example
Show findings with CVE Ids
drift.vulnerability.cveids: "CVE-2014-9999"
Example
Show findings with CVSS access vector
drift.vulnerability.cvssInfo.accessVector: "Local"
Example
Show findings with CVSS base score
drift.vulnerability.cvssInfo.baseScore: "7.2"
Example
Show findings with CVSS temporal score
drift.vulnerability.cvssInfo.temporalScore: "6.2"
Example
Show findings with CVSS3 base score
drift.vulnerability.cvss3Info.baseScore: "4.3"
Example
Show findings with CVSS3 temporal score
drift.vulnerability.cvss3Info.temporalScore: "3.8"
Example
Show findings with Remote discovery type
drift.vulnerability.discoveryType: "REMOTE"
Examples
Show findings first found within certain dates
drift.vulnerability.firstFound: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
drift.vulnerability.firstFound: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
drift.vulnerability.firstFound: [now-2w ... now-1s]
Show findings first found on certain date
drift.vulnerability.firstFound:'2017-09-22'
Show findings first found in the past 10 days with severity 5
drift.vulnerability: (firstFound > now-10d AND severity: "5")
Examples
Show findings first found within certain dates
drift.vulnerability.fixed: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
drift.vulnerability.fixed: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
drift.vulnerability.fixed: [now-2w ... now-1s]
Show findings first found on certain date
drift.vulnerability.fixed:'2017-09-22'
Show findings first found in the past 10 days with severity 5
drift.vulnerability: (fixed > now-10d AND severity: "5")
Examples
Show findings last found within certain dates
drift.vulnerability.lastFound: [2017-10-02 ... 2017-10-15]
Show findings last found starting 2017-10-01, ending 1 month ago
drift.vulnerability.lastFound: [2017-10-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
drift.vulnerability.lastFound: [now-2w ... now-1s]
Show findings last found on certain date
drift.vulnerability.lastFound:'2017-10-11'
Show findings last found on 2017-10-12 and category CGI
drift.vulnerability: (lastFound: '2017-10-12' AND category: "CGI")
Example
Show findings with libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4
drift.vulnerability.result: "libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4"
Example
Show findings with risk 50
drift.vulnerability.risk: 50
Examples
Show findings with severity 4
drift.vulnerability.severity: "4"
Show findings with severity 5 and category DNS
drift.vulnerability: (severity: "5" AND category: "DNS")
Example
Show findings with this status
drift.vulnerability.status: "OPEN"
Example
Show findings supported by VM
drift.vulnerability.supportedBy: "VM"
Examples
Show findings exposed to public exploit threats
drift.vulnerability.threatIntel: "publicExploit": true
Show findings exposed to multiple threats
drift.vulnerability.threatIntel: {"publicExploit" : true, "publicExploitNames" : ["Sambar Server 4.3/4.4 Beta 3 - Search CGI - The Exploit-DB Ref : 20223" ]}
Example
Show findings with this detection type
drift.vulnerability.typeDetected: "CONFIRMED"
Example
Show findings with QID 90405
drift.vulnerability.qid: 90405
Example
Show findings with title
drift.vulnerability.title: title text
Example
Show findings with software name
drift.vulnerability.software.name: my-app
Example
Show findings with software version
drift.vulnerability.software.version: 8.0
Example
Show findings with certain fix version
drift.vulnerability.software.fixVersion: 8.0
Example
Show drift software from images
drift.vulnerability.source: IMAGE
Example
Show drift software that is new
drift.vulnerability.reason: NEW
Example
Show containers exposed to threats due to active attacks
drift.vulnerability.threatIntel.activeAttacks: true
Example
Show containers having threats due to denial of service
drift.vulnerability.threatIntel.denialOfService: true
Example
Show containers exposed to threats due to easy exploit
drift.vulnerability.threatIntel.easyExploit: true
Example
Show containers exposed to threats due to high data loss
drift.vulnerability.threatIntel.highDataLoss: true
Example
Show containers exposed to threats due to high lateral movement
drift.vulnerability.threatIntel.highLateralMovement: true
Example
Show containers exposed to threats due to malware
drift.vulnerability.threatIntel.malware: true
Example
Show containers exposed to threats due to no patch available
drift.vulnerability.threatIntel.noPatch: true
Example
Show containers exposed to threats due to public exploit
drift.vulnerability.threatIntel.publicExploit: true
Example
Show findings with this SHA value
sha: 163dc7f6b91a30bdaa867c28e7edc341e72da63b0f9056be497bd59a83bce695
Example
Show containers with this software name
software.name: MyApp
Example
Show containers with this software version
software.version: 2.0.3
Example
Show containers with this software version
software.fixVersion: 2.0.3
Example
Show findings with Windows auth type
software.vulnerabilities.authType: "WINDOWS_AUTH"
Example
Show findings with category CGI
software.vulnerabilities.category: "CGI"
Examples
Show findings with customer-defined severity 4
software.vulnerabilities.customerSeverity: "4"
Show findings with customer-defined severity 5 and category DNS
software.vulnerabilities: (customerSeverity: "5" AND category: "DNS")
Example
Show findings with CVE Ids
software.vulnerabilities.cveids: "CVE-2014-9999"
Example
Show findings with CVSS access vector
software.vulnerabilities.cvssInfo.accessVector: "Local"
Example
Show findings with CVSS base score
software.vulnerabilities.cvssInfo.baseScore: "7.2"
Example
Show findings with CVSS temporal score
software.vulnerabilities.cvssInfo.temporalScore: "6.2"
Example
Show findings with CVSS3 base score
software.vulnerabilities.cvss3Info.baseScore: "4.3"
Example
Show findings with CVSS3 temporal score
software.vulnerabilities.cvss3Info.temporalScore: "3.8"
Example
Show findings with Remote discovery type
software.vulnerabilities.discoveryType: "REMOTE"
Examples
Show findings first found within certain dates
software.vulnerabilities.firstFound: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
software.vulnerabilities.firstFound: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
software.vulnerabilities.firstFound: [now-2w ... now-1s]
Show findings first found on certain date
software.vulnerabilities.firstFound:'2017-09-22'
Show findings first found in the past 10 days with severity 5
software.vulnerabilities: (firstFound > now-10d AND severity: "5")
Examples
Show findings first found within certain dates
software.vulnerabilities.fixed: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
software.vulnerabilities.fixed: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
software.vulnerabilities.fixed: [now-2w ... now-1s]
Show findings first found on certain date
software.vulnerabilities.fixed:'2017-09-22'
Show findings first found in the past 10 days with severity 5
software.vulnerabilities: (fixed > now-10d AND severity: "5")
Examples
Show findings last found within certain dates
software.vulnerabilities.lastFound: [2017-10-02 ... 2017-10-15]
Show findings last found starting 2017-10-01, ending 1 month ago
software.vulnerabilities.lastFound: [2017-10-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
software.vulnerabilities.lastFound: [now-2w ... now-1s]
Show findings last found on certain date
software.vulnerabilities.lastFound:'2017-10-11'
Show findings last found on 2017-10-12 and category CGI
software.vulnerabilities: (lastFound: '2017-10-12' AND category: "CGI")
Example
Show findings with libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4
software.vulnerabilities.result: "libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4"
Example
Show findings with risk 50
software.vulnerabilities.risk: 50
Examples
Show findings with severity 4
software.vulnerabilities.severity: "4"
Show findings with severity 5 and category DNS
software.vulnerabilities: (severity: "5" AND category: "DNS")
Example
Show findings supported by VM
software.vulnerabilities.supportedBy: "VM"
Examples
Show findings exposed to public exploit threats
software.vulnerabilities.threatIntel: "publicExploit": true
Show findings exposed to multiple threats
software.vulnerabilities.threatIntel: {"publicExploit" : true, "publicExploitNames" : ["Sambar Server 4.3/4.4 Beta 3 - Search CGI - The Exploit-DB Ref : 20223" ]}
Example
Show findings with this detection type
software.vulnerabilities.typeDetected: "CONFIRMED"
Example
Show findings with QID 90405
software.vulnerabilities.qid: 90405
Example
Show findings with title
software.vulnerabilities.title: title text
Example
Show findings with software name
software.vulnerabilities.software.name: my-app
Example
Show findings with software version
software.vulnerabilities.software.version: 8.0
Example
Show findings with certain fix version
software.vulnerabilities.software.fixVersion: 8.0
Example
Show software software from images
software.vulnerabilities.source: IMAGE
Example
Show software software that is new
software.vulnerabilities.reason: NEW
Example
Show containers exposed to threats due to active attacks
software.vulnerabilities.threatIntel.activeAttacks: true
Example
Show containers having threats due to denial of service
software.vulnerabilities.threatIntel.denialOfService: true
Example
Show containers exposed to threats due to easy exploit
software.vulnerabilities.threatIntel.easyExploit: true
Example
Show containers exposed to threats due to high data loss
software.vulnerabilities.threatIntel.highDataLoss: true
Example
Show containers exposed to threats due to high lateral movement
software.vulnerabilities.threatIntel.highLateralMovement: true
Example
Show containers exposed to threats due to malware
software.vulnerabilities.threatIntel.malware: true
Example
Show containers exposed to threats due to no patch available
software.vulnerabilities.threatIntel.noPatch: true
Example
Show containers exposed to threats due to public exploit
software.vulnerabilities.threatIntel.publicExploit: true
Example
Show containers on host
source: HOST
Example
Show containers in a certain state
state: "Running"
Examples
Show containers that changed state within certain dates
stateChanged: [2019-10-01 ... 2019-10-12]
Show containers that changed state starting October 1st and ending 1 month ago
stateChanged: [2019-10-01 ... now-1M]
Show containers that changed state starting 2 weeks ago, ending 1 second ago
stateChanged: [now-2w ... now-1s]
Show containers that changed state on certain date
stateChanged:'2019-09-22'
Examples
Find containers updated within certain dates
updated: [2019-06-15 ... 2019-06-30]
Find containers updated on specific date
updated:'2019-08-15'
Example
Show findings with this user name
users: asmith
Example
Show findings with Windows auth type
vulnerabilities.authType: "WINDOWS_AUTH"
Example
Show findings with category CGI
vulnerabilities.category: "CGI"
Examples
Show findings with customer-defined severity 4
vulnerabilities.customerSeverity: "4"
Show findings with customer-defined severity 5 and category DNS
vulnerabilities: (customerSeverity: "5" AND category: "DNS")
Example
Show findings with CVE name CVE-2015-0313
vulnerabilities.cveids: CVE-2015-0313
Example
Show findings with CVSS access vector
vulnerabilities.cvssInfo.accessVector: "Local"
Example
Show findings with CVSS base score
vulnerabilities.cvssInfo.baseScore: "7.2"
Example
Show findings with CVSS temporal score
vulnerabilities.cvssInfo.temporalScore: "6.2"
Example
Show findings with CVSS3 base score
vulnerabilities.cvss3Info.baseScore: "4.3"
Example
Show findings with CVSS3 temporal score
vulnerabilities.cvss3Info.temporalScore: "3.8"
Example
Show findings with Remote discovery type
vulnerabilities.discoveryType: "REMOTE"
Examples
Show findings first found within certain dates
vulnerabilities.firstFound: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
vulnerabilities.firstFound: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
vulnerabilities.firstFound: [now-2w ... now-1s]
Show findings first found on certain date
vulnerabilities.firstFound:'2017-09-22'
Show findings first found in the past 10 days with severity 5
vulnerabilities: (firstFound > now-10d AND severity: "5")
Examples
Show findings fixed within certain dates
vulnerabilities.fixed: [2017-10-01 ... 2017-10-12]
Show findings fixed starting 2017-10-01, ending 1 month ago
vulnerabilities.fixed: [2017-10-01 ... now-1M]
Show findings fixed starting 2 weeks ago, ending 1 second ago
vulnerabilities.fixed: [now-2w ... now-1s]
Show findings fixed on certain date
vulnerabilities.fixed:'2017-09-22'
Show findings fixed in the past 10 days with severity 5
vulnerabilities: (fixed > now-10d AND severity: "5")
Examples
Show findings last found within certain dates
vulnerabilities.lastFound: [2017-10-02 ... 2017-10-15]
Show findings last found starting 2017-10-01, ending 1 month ago
vulnerabilities.lastFound: [2017-10-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFound: [now-2w ... now-1s]
Show findings last found on certain date
vulnerabilities.lastFound:'2017-10-11'
Show findings last found on 2017-10-12 and category CGI
vulnerabilities: (lastFound: '2017-10-12' AND category: "CGI")
Example
Show findings for this product
vulnerabilities.product: "moodle"
Example
Show findings with libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4
vulnerabilities.result: "libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4"
Example
Show findings with risk 50
vulnerabilities.risk: 50
Example
Show findings with severity 4
vulnerabilities.severity: "4"
Show findings with severity 5 and category DNS
vulnerabilities: (severity: "5" AND category: "DNS")
Example
Show findings with this status
vulnerabilities.status: "OPEN"
Example
Show findings supported by VM
vulnerabilities.supportedBy: "VM"
Example
Show containers exposed to threats due to active attacks
vulnerabilities.threatIntel.activeAttacks: true
Example
Show containers having threats due to denial of service
vulnerabilities.threatIntel.denialOfService: true
Example
Show containers exposed to threats due to easy exploit
vulnerabilities.threatIntel.easyExploit: true
Example
Show containers exposed to threats due to high data loss
vulnerabilities.threatIntel.highDataLoss: true
Example
Show containers exposed to threats due to high lateral movement
vulnerabilities.threatIntel.highLateralMovement: true
Example
Show containers exposed to threats due to malware
vulnerabilities.threatIntel.malware: true
Example
Show containers exposed to threats due to no patch available
vulnerabilities.threatIntel.noPatch: true
Example
Show containers exposed to threats due to public exploit
vulnerabilities.threatIntel.publicExploit: true
Example
Show findings with this detection type
vulnerabilities.typeDetected: "CONFIRMED"
Example
Show findings for this vendor
vulnerabilities.vendor: "vendor-name"
Example
Show findings with QID 90405
vulnerabilities.qid: 90405
Example
Show findings with title
vulnerabilities.title: title text
Example
Show findings with software name
vulnerabilities.software.name: my-app
Example
Show findings with software version
vulnerabilities.software.version: 8.0
Example
Show findings with certain fix version
vulnerabilities.software.fixVersion: 8.0
Example
Show findings with service name
services.name: sshd
Example
Show findings with service description
services.description: Secure Socket Shell
Example
Show findings with service status
services.status: RUNNING
Example
Show containers in Running state and running processes as root
state: RUNNING and isRoot: true
Example
Show containers that are not in Running state
not state: RUNNING
Example
Show containers that are in one of these states
state: DELETED or state: UNKNOWN
Also see,
Searching for Container Exceptions