CS Old and New Search Token Mappings
The token standardization for the Qualys Query Language (QQL) search tokens follows a standard naming convention.
The new token format follows the syntax: entity.attribute
For example, the old token reportName is renamed to report.name, wherein, report is the entity, and name is the attribute.
- Only the new tokens are displayed in the auto-suggestion in the search bars within the UI. However, if you type the old token name manually, the QQL query still works. Old token names' visibility from the UI is removed.
- The existing Dashboard widgets and Saved Search Queries will continue to support the old tokens. You can edit search queries and widgets to update the new tokens.
- The API endpoints that use QQL tokens in the queries will work with the old tokens. You can edit the API query to include the new tokens.
The following is the old and new tokens mapping list:
Report TokensReport Tokens
| Old Token Name | New Token Name |
| reportName | report.name |
Scan Jobs TokensScan Jobs Tokens
| Old Token Name | New Token Name |
| filters.repoTags.repo | container.image.repo.repository |
| filters.repoTags.tag | container.image.repo.tag.name |
| onDemand | job.isOnDemand |
| status | job.status |
Secret Detectors TokensSecret Detectors Tokens
| Old Token Name | New Token Name |
| secretDetector | container.secretDetector.name |
| category | container.secretDetector.category |
| type | container.secretDetector.type |
| severity | container.secretDetector.severity |
| status | container.secretDetector.status |
Sensor Profile TokensSensor Profile Tokens
| Old Token Name | New Token Name |
| profileName | sensor.profile.name |
| createdBy | sensor.profile.createdBy.username |
| updatedBy | sensor.profile.updatedBy.username |
| profileUuid | sensor.profile.uuid |
| profileType | sensor.profile.type |
| tags.name | sensor.profile.tag.name |
Asset Activity TokensAsset Activity Tokens
| Old Token Name | New Token Name |
| activityType | activity.type |
| activityCode | activity.code |
| activityMessage | activity.message |
| activityTime | activity.time |
CRS File Events TokensCRS File Events Tokens
| Old Token Name | New Token Name |
| action | file.action |
| file.source | file.source |
| file.target | file.target |
| status | file.cluster.status |
| actor.process.name | actor.process.name |
| actor.process.parent_process.name | actor.process.parent.name |
| actor.process.xattributes.exec_id | actor.process.xattributes.execId |
| actor.authorizations.policy.name | actor.authorizations.policy.name |
| cloud.provider | cloud.provider |
| actor.process.parent_process.container.name | actor.process.parent.container.name |
| actor.process.container.name | actor.process.container.name |
| actor.process.container.uid | actor.process.container.uid |
| actor.process.parent_process.container.uid | actor.process.parent.container.uid |
| clusterName | container.cluster.name |
| namespaceName | file.namespaceName |
| nodeName | file.nodeName |
Exception TokensException Tokens
| Old Token Name | New Token Name |
| name | riskAcceptance.name |
| scope | riskAcceptance.scope |
| createdBy | riskAcceptance.createdBy.username |
| updatedBy | riskAcceptance.updatedBy.username |
| created | riskAcceptance.createdDate |
| updated | riskAcceptance.updatedDate |
| endDate | riskAcceptance.endDate |
| list.name | riskAcceptance.list.name |
| list.qids | riskAcceptance.list.qid |
Container Host Association TokensContainer Host Association Tokens
| Old Token Name | New Token Name |
| host.hostname | container.host.name |
| host.ipAddress | container.host.ipAddress |
| host.ipV6Address | container.host.ipV6Address |
Image Host Association TokensImage Host Association Tokens
| Old Token Name | New Token Name |
| host.hostname | container.image.host.name |
| host.ipAddress | container.image.host.ipAddress |
| host.ipV6Address | container.image.host.ipV6Address |
K8s Inventory Pod TokensK8s Inventory Pod Tokens
| Old Token Name | New Token Name |
| clusterUid | container.cluster.uid |
| name | container.cluster.k8s.pod.name |
| labels | container.cluster.k8s.pod.label |
| annotations | container.cluster.k8s.pod.annotation |
| status | container.cluster.k8s.pod.status |
| containers | container.cluster.k8s.pod.container |
| k8sExposure.exposedOutsideCluster | container.k8s.exposure.exposedOutsideCluster |
| k8sExposure.exposedToWorld | container.k8s.exposure.exposedToWorld |
K8s Policy EventK8s Policy Event
| Old Token Name | New Token Name |
| policy.uuid | policy.uuid |
| policy.version | policy.version |
| policyResult.evaluation | policy.result.evaluation |
| policy.scope | policy.scope |
| images.isMultiPlatformImage | container.image.isMultiPlatformImage |
| k8sAdmissionController.enforcementAction | policy.k8s.admissionController.enforcementAction |
| k8sAdmissionController.cluster.name | policy.k8s.admissionController.cluster.name |
| k8sAdmissionController.namespace.name | policy.k8s.admissionController.namespace.name |
K8s Posture Resources TokensK8s Posture Resources Tokens
| Old Token Name | New Token Name |
| accountId | container.k8s.resourcePostures.accountId |
| clusterName | container.cluster.name |
| clusterUid | container.cluster.uid |
| firstEvaluated | container.k8s.resourcePostures.firstEvaluatedDate |
| lastEvaluated | container.k8s.resourcePostures.lastEvaluatedDate |
| resourceUid | container.k8s.resourcePostures.resourceUid |
| resourceName | container.k8s.resourcePostures.resourceName |
| policyNames | container.k8s.resourcePostures.policyName |
| resourceLabels | container.k8s.resourcePostures.resourceLabel |
| resourceType | container.k8s.resourcePostures.resourceType |
| status | container.k8s.resourcePostures.status |
K8s Posture TokensK8s Posture Tokens
| Old Token Name | New Token Name |
| cid | container.k8s.resourcePostures.cid |
| controlName | container.k8s.resourcePostures.controlName |
| policyNames | container.k8s.resourcePostures.policyName |
| criticality | container.k8s.resourcePostures.criticality |
| resourcePostures.status | container.k8s.resourcePostures.status |
| resourcePostures.clusterName | container.cluster.name |
| resourcePostures.clusterUid | container.cluster.uid |
| resourcePostures.dateEvaluated | container.k8s.resourcePostures.evaluatedDate |
| resourcePostures.resourceUid | container.k8s.resourcePostures.resourceUid |
| resourcePostures.resourceType | container.k8s.resourcePostures.resourceType |
Registry Repository TokensRegistry Repository Tokens
Old Token Name
New Token Name
repositoryName
asset.repositoryName
Registry TokensRegistry Tokens
| Old Token Name | New Token Name |
| registryUri | container.image.registry.uri |
| registryName | container.image.registry.name |
Hosts TokensHosts Tokens
| Old Token Name | New Token Name |
| connectors.connector.name | connector.name |
| system.biosDescription | asset.biosDescription |
| system.manufacturer | hardware.manufacturer |
| system.model | hardware.model |
| system.totalMemory | asset.totalMemory |
| system.timezone | asset.timezone |
| software.name | software.name |
| software.version | software.version |
| software.installedDate | software.installDate |
| openPorts.port | openPorts.port |
| openPorts.protocol | openPorts.protocol |
| processors.description | processor.description |
| processors.speed | processor.speed |
| services.name | service.name |
| services.description | service.description |
| accounts.username | account.username |
| interfaces.dnsAddress | asset.interface.dnsAddress |
| operatingSystem | operatingSystem.name |
| name | asset.name |
| updated | asset.lastUpdatedDate |
| created | asset.createdDate |
| netbiosName | asset.netbiosName |
| system.lastBoot | asset.lastBootDate |
| interfaces.hostname | asset.interface.hostname |
| interfaces.macAddress | asset.interface.macAddress |
| interfaces.address | asset.interface.address |
| services.status | service.status |
| software.firstFound | software.firstFoundDate |
| software.lastUpdated | software.lastUpdatedDate |
| openPorts.firstFound | openPorts.firstFoundDate |
| openPorts.lastUpdated | openPorts.lastUpdatedDate |
| volumes.name | volume.name |
| volumes.size | volume.size |
| volumes.free | volume.free |
| pendingActivationForModules | sensor.pendingActivationForModules |
| openPorts.detectedService | openPorts.detectedService |
| openPorts.description | openPorts.description |
| interfaces.interfaceName | asset.interface.name |
| interfaces.gatewayAddress | asset.interfaces.gatewayAddress |
| lastLoggedOnUser | asset.lastLoggedOnUser |
| agentId | qualys.agent.id |
| assetId | asset.id |
| lastInventory | qualys.agent.lastInventoryDate |
| lastCheckedIn | qualys.agent.lastCheckedInDate |
| lastFullScan | sensor.lastFullScanDate |
| lastComplianceScanDate | sensor.lastComplianceScanDate |
| lastVmScanDate | sensor.lastVmScanDate |
| configurationProfile | qualys.agent.configurationProfile |
| cpuCount | asset.cpuCount |
| agentVersion | qualys.agent.version |
| agentActivations.key | qualys.agent.activationKey.id |
| agentActivations.status | qualys.agent.activationKey.status |
| vulnerabilities | asset.isVulnerable |
| docker.hasSensor | docker.hasSensor |
| docker.dockerVersion | docker.version |
| docker.noOfContainers | docker.noOfContainers |
| docker.noOfImages | docker.noOfImages |
Image TokensImage Tokens
| Old Token Name | New Token Name |
| architecture | container.image.architecture |
| firstFound | container.image.firstFoundDate |
| created | container.image.createdDate |
| updated | container.image.updatedDate |
| host.hostname | container.image.host.name |
| host.ipAddress | container.image.host.ipAddress |
| host.ipV6Address | container.image.host.ipV6Address |
| hostArchitecture | container.image.host.architecture |
| imageId | container.image.id |
| label.key | container.image.label.key |
| label.value | container.image.label.value |
| lastVmScanDate | container.image.lastVmScanDate |
| layers.comment | container.image.layer.comment |
| layers.createdBy | container.image.layer.createdBy |
| layers.created | container.image.layer.createdDate |
| layers.id | container.image.layer.id |
| layers.sha | container.image.layer.sha |
| layers.size | container.image.layer.sizeInBytes |
| layers.tags | container.image.layer.tag |
| layersCount | container.image.layer.count |
| operatingSystem | container.image.operatingSystem.name |
| repo.registry | container.image.repo.registry |
| repo.repository | container.image.repo.repository |
| repo.tag | container.image.repo.tag.name |
| repoDigests.registry | container.image.repoDigest.registry |
| repoDigests.repository | container.image.repoDigest.repository |
| repoDigests.digest | container.image.repoDigest.digest |
| sha | container.image.sha |
| software.name | software.name |
| software.version | software.version |
| software.fixVersion | software.fixVersion |
| software.vulnerabilities.threatIntel.activeAttacks | software.vulnerabilities.threatIntel.isActiveAttack |
| users | container.image.user.username |
| author | container.image.author |
| dockerVersion | container.image.dockerVersion |
| size | container.image.sizeInBytes |
| services.name | container.image.service.name |
| services.description | container.image.service.description |
| services.status | container.image.service.status |
| registryUuid | container.image.registryUuid |
| source | container.image.source |
| isDockerHubOfficial | container.image.isDockerHubOfficial |
| scanType | container.image.scanType |
| scanStatus | container.image.scanStatus |
| scanErrorCode | container.image.scanErrorCode |
| lastComplianceScanDate | container.image.lastComplianceScanDate |
| tags.name | asset.container.image.tag.name |
| container.tags.name | asset.container.instance.tag.name |
| secrets.severity | secret.severity |
| exceptions.name | riskAcceptance.name |
| lastMalwareScanned | container.image.lastMalwareScanDate |
| lastSecretScanned | container.image.lastSecretScanDate |
| imagesInUse | container.image.lastUsedDate |
| qdsSeverity | container.image.qdsSeverity |
| maxQdsScore | container.image.maxQdsScore |
| riskScore | asset.truRisk |
| hasBaseImage | container.image.hasBaseImage |
| hasSecrets | container.image.hasSecrets |
| software.lifecycle.eos | software.lifecycle.eos |
| software.lifecycle.eol | software.lifecycle.eol |
| software.lifecycle.ga | software.lifecycle.ga |
| software.lifecycle.stage | software.lifecycle.stage |
| baseImage | container.image.baseImage |
| baseImagesForChildImages | container.image.baseImagesForChildImages |
| hasChildImage | container.image.hasChildImage |
K8s Cluster TokensK8s Cluster Tokens
| Old Token Name | New Token Name |
| clusterUid | container.cluster.uid |
| recordCreated | container.cluster.recordCreatedDate |
| recordUpdated | container.cluster.recordUpdatedDate |
| status | container.cluster.status |
| clusterName | container.cluster.name |
| provider | cloudProvider.name |
| AWS.arn | container.aws.eks.arn |
| AZURE.id | container.azure.aks.resourceId |
| GCP.krn | container.gcp.gke.krn |
| OCI.ocid | container.oci.oke.ocid |
Sensor TokensSensor Tokens
| Old Token Name | New Token Name |
| created | sensor.createdDate |
| lastCheckedIn | sensor.lastCheckedInDate |
| activationUuid | sensor.activationUuid |
| sensorVersion | sensor.version |
| hostname | sensor.hostname |
| dockerVersion | sensor.dockerVersion |
| label.key | sensor.label.key |
| label.value | sensor.label.value |
| ipv4 | sensor.ipAddress |
| ipv6 | sensor.ipV6Address |
| name | sensor.name |
| macAddress | sensor.macAddress |
| os | sensor.os |
| registry | sensor.registry |
| imageId | sensor.imageId |
| imageSha | sensor.imageSha |
| sha | sensor.sha |
| sensorId | sensor.id |
| containerIpv4 | sensor.containerIpv4 |
| containerIpv6 | sensor.containerIpv6 |
| containerMacAddress | sensor.containerMacAddress |
| status | sensor.status |
| privileged | sensor.isPrivileged |
| sensorType | sensor.type |
| uuid | sensor.uuid |
| containerRuntime | sensor.containerRuntime |
| containerRuntimeVersion | sensor.containerRuntimeVersion |
| cluster.type | sensor.cluster.type |
| cluster.k8s.project | sensor.cluster.k8s.project |
| cluster.k8s.pod.name | sensor.cluster.k8s.pod.name |
| cluster.k8s.pod.uuid | sensor.cluster.k8s.pod.uuid |
| cluster.k8s.pod.label.key | sensor.cluster.k8s.pod.label.key |
| cluster.k8s.pod.label.value | sensor.cluster.k8s.pod.label.value |
| cluster.k8s.pod.namespace | sensor.cluster.k8s.pod.namespace |
| cluster.k8s.pod.namespaceMetadata.annotations | sensor.cluster.k8s.pod.namespaceMetadata.annotations |
| cluster.k8s.pod.namespaceMetadata.labels | sensor.cluster.k8s.pod.namespaceMetadata.labels |
| cluster.k8s.pod.controller.name | sensor.cluster.k8s.pod.controller.name |
| cluster.k8s.pod.controller.type | sensor.cluster.k8s.pod.controller.type |
| cluster.k8s.pod.controller.uuid | sensor.cluster.k8s.pod.controller.uuid |
| cluster.k8s.node.name | sensor.cluster.k8s.node.name |
| cluster.k8s.node.isMaster | sensor.cluster.k8s.node.isMaster |
| architecture | sensor.architecture |
| cloudProvider.aws.ec2.instanceId | aws.ec2.instanceId |
| activityCode | sensor.activityCode |
| tags.name | sensor.tag.name |
Container TokensContainer Tokens
| Old Token Name | New Token Name |
| arguments | container.instance.arguments |
| command | container.instance.command |
| containerId | container.instance.id |
| created | container.instance.createdDate |
| updated | container.instance.updatedDate |
| environment | container.instance.environment |
| host.hostname | container.instance.host.name |
| host.ipAddress | container.instance.host.ipAddress |
| host.ipV6Address | container.instance.host.ipV6Address |
| hostArchitecture | container.instance.host.architecture |
| imageId | container.instance.image.id |
| imageSha | container.instance.image.sha |
| ipv4 | container.instance.ipAddress |
| ipv6 | container.instance.ipV6Address |
| isDrift | container.instance.isDrift |
| label.key | container.instance.label.key |
| label.value | container.instance.label.value |
| lastVmScanDate | container.instance.lastVmScanDate |
| macAddress | container.instance.macAddress |
| name | container.instance.name |
| operatingSystem | container.instance.operatingSystem.name |
| path | container.instance.path |
| portMapping.hostIp | container.instance.portMapping.hostIp |
| portMapping.hostPort | container.instance.portMapping.hostPort |
| portMapping.port | container.instance.portMapping.containerPort |
| portMapping.protocol | container.instance.portMapping.protocol |
| privileged | container.instance.isPrivileged |
| isRoot | container.instance.isRoot |
| drift.category | drift.category |
| drift.reason | drift.reason |
| drift.software.name | drift.software.name |
| drift.software.version | drift.software.version |
| drift.software.fixVersion | drift.software.fixVersion |
| sha | container.instance.sha |
| software.name | software.name |
| software.version | software.version |
| software.fixVersion | software.fixVersion |
| state | container.instance.state |
| stateChanged | container.instance.isStateChanged |
| users | container.instance.user.username |
| services.name | container.service.name |
| services.description | container.service.description |
| services.status | container.service.status |
| source | container.source |
| lastComplianceScanDate | container.instance.lastComplianceScanDate |
| cluster.type | container.cluster.type |
| cluster.k8s.project | container.cluster.k8s.project |
| cluster.k8s.pod.name | container.cluster.k8s.pod.name |
| cluster.k8s.pod.uuid | container.cluster.k8s.pod.uuid |
| cluster.k8s.pod.label.key | container.cluster.k8s.pod.label.key |
| cluster.k8s.pod.label.value | container.cluster.k8s.pod.label.value |
| cluster.k8s.pod.namespace | container.cluster.k8s.pod.namespace |
| cluster.k8s.pod.controller.name | container.cluster.k8s.pod.controller.name |
| cluster.k8s.pod.controller.type | container.cluster.k8s.pod.controller.type |
| cluster.k8s.pod.controller.uuid | container.cluster.k8s.pod.controller.uuid |
| cluster.k8s.node.name | container.cluster.k8s.node.name |
| cluster.k8s.node.isMaster | container.cluster.k8s.node.isMaster |
| cluster.k8s.pod.namespaceMetadata.annotations | container.cluster.k8s.pod.namespaceMetadata.annotations |
| cluster.k8s.pod.namespaceMetadata.labels | container.cluster.k8s.pod.namespaceMetadata.labels |
| cloudProvider.aws.ecs.clusterName | aws.ecs.cluster.name |
| cloudProvider.aws.ecs.accountId | aws.ecs.accountId |
| cloudProvider.aws.ecs.region.code | aws.ecs.region.code |
| cloudProvider.aws.ecs.container.macAddress | aws.ecs.container.macAddress |
| cloudProvider.aws.ecs.container.subnetId | aws.ecs.container.subnetId |
| cloudProvider.aws.ecs.container.id | aws.ecs.container.id |
| cloudProvider.aws.ec2.instanceId | aws.ec2.instanceId |
| image.tags.name | asset.container.image.tag.name |
| tags.name | asset.container.instance.tag.name |
| exceptions.name | riskAcceptance.name |
| qdsSeverity | container.instance.qdsSeverity |
| maxQdsScore | container.instance.maxQdsScore |
| riskScore | asset.truRisk |
| k8sExposure.exposedOutsideCluster | container.k8s.exposure.exposedOutsideCluster |
| k8sExposure.exposedToWorld | container.k8s.exposure.exposedToWorld |
| cloudProvider.aws.eks.arn | aws.eks.arn |
| cloudProvider.aws.eks.accountId | aws.eks.accountId |
| cloudProvider.aws.eks.region | aws.eks.region |
| cloudProvider.gcp.gke.krn | gcp.gke.krn |
| cloudProvider.gcp.gke.accountId | gcp.gke.accountId |
| cloudProvider.gcp.gke.region | gcp.gke.region |
| cloudProvider.azure.aks.resourceId | azure.aks.resourceId |
| cloudProvider.azure.aks.accountId | azure.aks.accountId |
| cloudProvider.azure.aks.region | azure.aks.region |
| cloudProvider.oci.oke.ocid | oci.oke.ocid |
| cloudProvider.oci.oke.accountId | oci.oke.accountId |
| cloudProvider.oci.oke.region | oci.oke.region |
| cloudProvider.selfManaged.clusterId | container.selfManaged.clusterId |
| cloudProvider.selfManaged.accountId | container.selfManaged.accountId |
| cloudProvider.selfManaged.region | container.selfManaged.region |
| cluster.name | container.cluster.name |
| cluster.uid | container.cluster.uid |
| accountQlp | container.instance.account.qlp |
| clusterQlp | container.instance.cluster.qlp |
| namespaceQlp | container.instance.namespace.qlp |
| podQlp | container.instance.pod.qlp |
| containerQlp | container.instance.qlp |
CICD Policy TokensCICD Policy Tokens
| Old Token Name | New Token Name |
| policy.uuid | policy.uuid |
| policy.version | policy.version |
| policyResult.evaluation | policy.result.evaluation |
| images.repo.registry | container.image.repo.registry |
| images.repo.repository | container.image.repo.repository |
| images.repo.tag | container.image.repo.tag.name |
| policy.tags.name | policy.tag.name |
Centralized Policy TokensCentralized Policy Tokens
| Old Token Name | New Token Name |
| policyName | policy.name |
| createdBy | rule.createdBy.username |
| updatedBy | rule.updatedBy.username |
| uuid | policy.uuid |
| policyMode | policy.mode |
| isDefault | policy.isDefault |
| policyType | policy.type |
| k8sFilters.cluster.clusterUid | policy.k8s.filter.cluster.clusterUid |
| k8sFilters.namespace.clusterUid | policy.k8s.filter.namespace.clusterUid |
| k8sFilters.namespace.namespaceValue | policy.k8s.filter.namespace.value |
| policy.tags.name | policy.tag.name |
CRS Process Events TokensCRS Process Events Tokens
| Old Token Name | New Token Name |
| action | process.action |
| status | process.status |
| process.name | process.name |
| actor.process.name | actor.process.name |
| process.container.uid | process.container.uid |
| actor.process.container.uid | actor.process.container.uid |
| process.container.name | process.container.name |
| actor.process.container.name | actor.process.container.name |
| process.xattributes.exec_id | process.xattributes.execId |
| cloud.provider | cloud.provider |
| clusterName | container.cluster.name |
| namespaceName | process.namespaceName |
| nodeName | process.nodeName |
Vulnerability List TokensVulnerability List Tokens
| Old Token Name | New Token Name |
| name | riskAcceptance.list.name |
| createdBy | riskAcceptance.list.createdBy.username |
| updatedBy | riskAcceptance.list.updatedBy.username |
| created | riskAcceptance.list.createdDate |
| updated | riskAcceptance.list.updatedDate |
Software TokensSoftware Tokens
| Old Token Name | New Token Name |
| name | software.name |
| version | software.version |
| fixVersion | software.fixVersion |
| scanType | software.scanType |
| lifecycle.eos | software.lifecycle.eos |
| lifecycle.eol | software.lifecycle.eol |
| lifecycle.ga | software.lifecycle.ga |
| lifecycle.stage | software.lifecycle.stage |
Executions Image TokensExecutions Image Tokens
| Old Token Name | New Token Name |
| scannedBySensorId | sensor.uuid |
| status | job.execution.status |
| imageId | container.image.id |
Executions TokensExecutions Tokens
| Old Token Name | New Token Name |
| listedBySensorId | sensor.uuid |
| status | job.execution.status |