Searching for Hosts
Use the search tokens below to search for hosts. Looking for help with writing your query? click here
Amazon AWS
Use these tokens when searching Amazon AWS assets.
aws.ec2.accountIdaws.ec2.accountId
Use a text value ##### to find EC2 instances with a certain account ID.
Examples
Find EC2 instances that match this account ID
aws.ec2.accountId: 123456789012
Find EC2 instances with account ID starting "12345"
aws.ec2.accountId: 12345*
Find EC2 instances where account ID is null (remove the colon)
aws.ec2.accountId is null
aws.ec2.availabilityZoneaws.ec2.availabilityZone
Use a text value ##### to find EC2 instances by the availability zone in which the instance launched.
Example
Find EC2 instances in the us-east-1a availability zone
aws.ec2.availabilityZone: us-east-1a
aws.ec2.hasAgentaws.ec2.hasAgent
Use the values true | false to define whether the EC2 asset has a cloud agent.
Examples
Show findings with a cloud agent
aws.ec2.hasAgent: true
Show findings without a cloud agent
aws.ec2.hasAgent: false
aws.ec2.hostnameaws.ec2.hostname
Use a text value ##### to find the EC2 hostname you're looking for.
Examples
Find instances related to name
aws.ec2.hostname: abc.qualys.com
Find instances that match exact value
aws.ec2.hostname: `abc.qualys.com`
aws.ec2.imageIdaws.ec2.imageId
Use a text value ##### to find EC2 instances with a certain Image (AMI) ID.
Examples
Find instances related to the Image ID
aws.ec2.imageId: ami-2ea83347
Find instances that match exact value
aws.ec2.imageId: `ami-2ea83347`
aws.ec2.instanceIdaws.ec2.instanceId
Use a text value ##### to find EC2 instances by the instance ID.
Example
Find EC2 instances with this ID
aws.ec2.instanceId: i-1234567890abcdef0
aws.ec2.instanceStateaws.ec2.instanceState
Select the name of the instance state (e.g. PENDING, RUNNING, TERMINATED, STOPPED, etc) you're interested in. Select from names in the drop-down menu.
Example
Find running EC2 instances
aws.ec2.instanceState: RUNNING
aws.ec2.instanceTypeaws.ec2.instanceType
Select the type of instance you're interested in. Select from names in the drop-down menu.
Example
Find EC2 instances with instance type t2.micro
aws.ec2.instanceType: t2.micro
aws.ec2.isQualysScanneraws.ec2.isQualysScanner
Use the values true | false to define whether the EC2 asset is a Qualys scanner.
Examples
Show findings where assets are scanners
aws.ec2.isQualysScanner: true
Show findings where assets are not scanners
aws.ec2.isQualysScanner: false
aws.ec2.kernelIdaws.ec2.kernelId
Use a text value ##### to find EC2 instances by kernel ID (AKI).
Example
Find EC2 instances with this kernel ID
aws.ec2.kernelId: aki-70ab0c10
aws.ec2.launchDateaws.ec2.launchDate
Use a date range or specific date to define when the EC2 instance launched. Enter dates in yyyy-mm-dd format.
Examples
Find EC2 instances launched within certain dates
aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]
Find EC2 instances launched on specific date
aws.ec2.launchDate:'2017-08-15'
aws.ec2.privateDNSaws.ec2.privateDNS
Use a text value ##### to define a private DNS address you're interested in.
Example
Find the EC2 instance with this private DNS address
aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal
aws.ec2.privateIpAddressaws.ec2.privateIpAddress
Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.
Examples
Find EC2 instances with this private IP address
aws.ec2.privateIpAddress: 10.90.0.119
Find EC2 instances within this IP range
aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]
aws.ec2.publicDNSaws.ec2.publicDNS
Use a text value ##### to define a public DNS address you're interested in.
Example
Find the EC2 instance with this public DNS address
aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com
aws.ec2.publicIpAddressaws.ec2.publicIpAddress
Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.
Examples
Find EC2 instances with this public IP address
aws.ec2.publicIpAddress: 52.70.141.154
Find EC2 instances within this IP range
aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]
aws.ec2.region.codeaws.ec2.region.code
Select the code of the region you're interested in. Select from codes in the drop-down menu.
Example
Find EC2 instances in the us-east-1 region
aws.ec2.region.code: us-east-1
aws.ec2.region.nameaws.ec2.region.name
Select the name of the region you're interested in. Select from names in the drop-down menu.
Example
Find EC2 instances in the US East (N. Virginia) region
aws.ec2.region.name: US East (N. Virginia)
aws.ec2.spotInstanceaws.ec2.spotInstance
Use the values true | false to define whether your EC2 instance is a Spot instance.
Examples
Show EC2 Spot instances
aws.ec2.spotInstance: "true"
Show EC2 instances that are not Spot instances
aws.ec2.spotInstance: "false"
aws.ec2.subnetIdaws.ec2.subnetId
Use a text value ##### to find EC2 instances by the ID of the subnet in which the interface resides.
Example
Find EC2 instances with this subnet ID
aws.ec2.subnetId: subnet-bc02c0d4
aws.ec2.vpcIdaws.ec2.vpcId
Use a text value ##### to find EC2 instances by the ID of the VPC in which the interface resides.
Example
Find EC2 instances with this VPC ID
aws.ec2.vpcId: vpc-1e37cd76
Microsoft Azure
Use these tokens when searching Microsoft Azure assets.
azure.vm.imageOfferazure.vm.imageOffer
Use a text value ##### to define the image offer name (i.e. UbuntuServer or WindowsServer) for images deployed from the Azure image gallery.
Examples
Find Azure instances related to name
azure.vm.imageOffer: UbuntuServer
Find Azure instances that match exact value
azure.vm.imageOffer: `UbuntuServer`
azure.vm.imagePublisherazure.vm.imagePublisher
Use a text value ##### to define the name of the Azure virtual machine image publisher (i.e. Canonical or MicrosoftWindowsServer).
Examples
Find Azure instances related to name
azure.vm.imagePublisher: Canonical
Find Azure instances that match exact value
azure.vm.imagePublisher: `Canonical`
azure.vm.imageVersionazure.vm.imageVersion
Use a text value ##### to define the version of the Azure virtual machine image sku you're interested in.
Example
Find Azure instances with this sku version
azure.vm.imageVersion: 16.04.201708030
azure.vm.locationazure.vm.location
Use a text value ##### to define the region you're interested in.
Example
Find Azure instances in this location
azure.vm.location: westus
azure.vm.macAddressazure.vm.macAddress
Use a text value ##### to define the MAC address you're interested in.
Example
Find Azure instances with this MAC address
azure.vm.macAddress: '000D3A36DDED'
azure.vm.nameazure.vm.name
Use a text value ##### to find the Azure virtual machine name you're looking for.
Examples
Find Azure instances related to name
azure.vm.name: avset2
Find Azure instances that match exact value
azure.vm.name: `avset2`
azure.vm.platformazure.vm.platform
Use a text value ##### to define the operating system platform (Linux or Windows) of the Azure virtual machine.
Example
Find Azure instances on Windows platform
azure.vm.platform: Windows
azure.vm.privateIpAddressazure.vm.privateIpAddress
Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.
Examples
Find Azure instances with this private IP
azure.vm.privateIpAddress: 10.1.2.5
Find Azure instances within this IP range
azure.vm.privateIpAddress: [10.1.2.5 ... 10.1.2.33]
azure.vm.publicIpAddressazure.vm.publicIpAddress
Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.
Examples
Find Azure instances with this public IP
azure.vm.publicIpAddress: 13.126.125.189
Find Azure instances within this IP range
azure.vm.publicIpAddress: [13.126.125.180 ... 13.126.125.255]
azure.vm.resourceGroupNameazure.vm.resourceGroupName
Use a text value ##### to define the name of the resource group you're interested in.
Examples
Find Azure instances related to name
azure.vm.resourceGroupName: my-eastus-rg
Find Azure instances that match exact value
azure.vm.resourceGroupName: `my-eastus-rg`
azure.vm.sizeazure.vm.size
Use a text value ##### to help you find Azure VM instances with a certain virtual machine size.
Example
Find Azure instances with this size
azure.vm.size: Standard_D1
azure.vm.stateazure.vm.state
Select the name of the instance state (e.g. PENDING, RUNNING, SHUTTING_DOWN, TERMINATED, etc.) you're interested in. Select from names in the drop-down menu.
Example
Find running Azure instances
azure.vm.state: RUNNING
azure.vm.subnetazure.vm.subnet
Use a text value ##### to define the Azure virtual machine subnet you're interested in.
Example
Find Azure instances with this subnet
azure.vm.subnet: 10.1.2.0
azure.vm.subscriptionIdazure.vm.subscriptionId
Use a text value ##### to define the subscription ID of the Azure virtual machine subscription.
Example
Find Azure instances with this subscription ID
azure.vm.subscriptionId: fbb9ea64-abda-452e-adfa-83442409
azure.vm.vmIdazure.vm.vmId
Use a text value ##### to define the Azure virtual machine ID you're looking for.
Example
Find Azure instances with this ID
azure.vm.vmId: 13f56399-bd52-4150-9748-7190aae1ff21
Google Cloud Platform
Use these tokens when searching Google Cloud Platform assets.
gcp.compute.hostnamegcp.compute.hostname
Use a text value ##### to define the hostname you're looking for.
Examples
Find GCP instances related to name
gcp.compute.hostname: instance-5.c.qvsa-dev.internal
Find GCP instances that match exact value
gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`
gcp.compute.instanceIdgcp.compute.instanceId
Use a text value ##### to define the Google Compute instance ID you're looking for.
Example
Find GCP instances with this ID
gcp.compute.instanceId: 4392196237934605253
gcp.compute.macAddressgcp.compute.macAddress
Use a text value ##### to define the MAC address you're interested in.
Example
Find GCP instances with this MAC address
gcp.compute.macAddress: '000D3A36DDED'
gcp.compute.machineTypegcp.compute.machineType
Use a text value ##### to define the machine type of the virtual machine instance you're interested in.
Examples
Find GCP instances related to name
gcp.compute.machineType: n1-standard-1
Find GCP instances that match exact value
gcp.compute.machineType: `n1-standard-1`
gcp.compute.networkgcp.compute.network
Use a text value ##### to find GCP instances by the VPC network the instance belongs to.
Example
Find GCP instances with this network
gcp.compute.network: 000D3A36DDED
gcp.compute.privateIpAddressgcp.compute.privateIpAddress
Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.
Examples
Find GCP instances with this private IP
gcp.compute.privateIpAddress: 10.240.0.7
Find GCP instances with this private IP range
gcp.compute.privateIpAddress: [10.240.0.7 ... 10.240.0.30]
gcp.compute.projectIdgcp.compute.projectId
Use a text value ##### to define the project ID assigned to the GCP Console project the instance belongs to.
Examples
Find GCP instances related to ID
gcp.compute.projectId: qvsa-dev
Find GCP instances that match exact value
gcp.compute.projectId: `qvsa-dev`
gcp.compute.projectNumbergcp.compute.projectNumber
Use an integer value ##### to define the project number assigned to the GCP Console project the instance belongs to.
Examples
Find GCP instances related to this number
gcp.compute.projectNumber: 1035365309337
Find GCP instances that match exact value
gcp.compute.projectNumber: `1035365309337`
gcp.compute.publicIpAddressgcp.compute.publicIpAddress
Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.
Examples
Find GCP instances with this public IP
gcp.compute.publicIpAddress: 104.196.57.216
Find GCP instances within this IP range
gcp.compute.publicIpAddress: [104.196.57.216 ... 104.196.57.218]
gcp.compute.zonegcp.compute.zone
Use a text value ##### to define the zone of the GCP instance you're looking for
Examples
Find GCP instances related to name
gcp.compute.zone: us-east1-d
Find GCP instances that match exact value
gcp.compute.zone: `us-east1-d`
Assets
All tokens below are available for Asset search.
accounts.usernameaccounts.username
Use a text value ##### to find the username you're looking for.
Example
Show assets with this exact username (case sensitive)
accounts.username: Administrator
Show assets with username starting with "Admin" (case sensitive)
accounts.username: Admin
activatedForModulesactivatedForModules
Select the name ##### of an activated module you're interested in. Select from names in the drop-down menu.
Examples
Show assets activated for VM
activatedForModules: "VM"
Show assets activated for VM and PC
activatedForModules: "VM" AND activatedForModules: "PC"
agentActivations.keyagentActivations.key
Use a text value ##### to define the agent activation key you're interested in.
Example
Show assets with agents activated using this key
agentActivations.key: 057cc48a-8d84-48eb-add4-97a605d0567d
agentActivations.statusagentActivations.status
Select the agent activation status (ACTIVE, INACTIVE, UNSUPPORTED) you're interested in. Select from names in the drop-down menu.
Example
Show assets with active agents
agentActivations.status: ACTIVE
agentIdagentId
Use a text value ##### to find an agent ID of interest.
Example
Show the asset with this agent ID
agentID: f0c8e682-e9cc-4e7d-b92a-0c905d81ec74
agentVersionagentVersion
Use a text value ##### to find the agent version you're interested in.
Example
Show findings with agent version 1.3.2.0
agentVersion: 1.3.2.0
assetIdassetId
Use an integer value ##### to help you find certain Qualys asset IDs (UUIDs), assigned by an agent or a scanner appliance when Agentless Tracking is used.
Examples
Show this asset ID
assetId: 2918869
Show asset IDs in this range
assetId: [3546997 .. 12945655]
Show the 2 asset IDs listed
assetId: [3546997,12945655]
configurationProfileconfigurationProfile
Use values within quotes or backticks to help you find the agent configuration profile you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to profile name
configurationProfile: Initial Profile
Show any findings that contain parts of the name
configurationProfile: "Initial Profile"
Show any findings that match exact value
configurationProfile: `Initial Profile`
connectors.connector.nameconnectors.connector.name
Use a text value ##### to define the connector name you're interested in.
Example
Show findings detected by connector name myec2
connectors.connector.name: myec2
cpuCountcpuCount
Use an integer value ##### to help you find assets with some number of CPUs.
Example
Show assets that have 2 CPUs
cpuCount: 2
connectedFromconnectedFrom
Use a text value ##### to define the external IP address a cloud agent connected from.
Example
Show findings for an external IP address that an agent connected from
connectedFrom: 10.0.100.11
createdcreated
Use a date range or specific date to define when assets were created (i.e. when first scanned by a scanner appliance, or when agent was installed).
Examples
Show assets created within certain dates
created: [2016-01-01 ... 2016-01-10]
Show assets created starting 2015-10-01, ending 1 month ago
created: [2015-10-01 ... now-1M]
Show assets created starting 2 weeks ago, ending 1 second ago
created: [now-2w ... now-1s]
Show assets created on specific date
created:'2016-01-08'
docker.dockerVersiondocker.dockerVersion
Use a text value ##### to define a Docker version you're looking for.
Example
Show findings with this Docker version
docker.dockerVersion:17.3
docker.hasSensordocker.hasSensor
Use the values true | false to choose whether to show Docker hosts that have the Container Sensor installed.
Example
Show docker hosts where sensor is installed
docker.hasSensor:true
docker.noOfContainersdocker.noOfContainers
Use an integer value ##### to help you find assets with some number of Docker containers. The value is displayed only for VM scan or Agent scan (and not for sensors).
Example
Show findings with 2 Docker containers
docker.noOfContainers:2
docker.noOfImagesdocker.noOfImages
Use an integer value ##### to help you find assets with some number of Docker images. The value is displayed only for VM scan or Agent scan (and not for sensors).
Example
Show findings with 5 Docker images
docker.noOfImages:5
errorStatuserrorStatus
Use the values true | false to define agents with or without error status.
Example
Show agents with error status
errorStatus: "true"
fimCapablefimCapable
Use the values true | false to define whether or not agents are FIM capable. fimCapable search is not supported for all operating systems. Check the Cloud Agent Getting Started Guide for platform/OS support.
Examples
Show agents that are FIM capable and activated for FIM
fimCapable: "true"
Show agents that are not FIM capable but can be upgraded to FIM capability
fimCapable: "false"
hostIdhostId
Use an integer value ##### to help you find the asset with a certain Qualys host ID (UUID), assigned by an agent or a scanner appliance when Agentless Tracking is used.
Example
Show assets that have this host ID
hostId: 2918869
interfaces.addressinterfaces.address
Use a text value ##### to define an IP address (IPv4 of IPv6) you're interested in. Note that you cannot perform a range search since this is a text field.
Examples
Show the asset with IPv4 address
interfaces.address: 10.10.100.20
Show the asset with IPv6 address (enclose value in single quotes)
interfaces.address: 'fe80:0:0:0:2501:b53c:4139:404b'
interfaces.dnsAddressinterfaces.dnsAddress
Use a text value ##### to define a DNS address you're interested in.
Example
Show the asset with DNS address 10.0.100.11
interfaces.dnsAddress: 10.0.100.11
interfaces.gatewayAddressinterfaces.gatewayAddress
Use a text value ##### to help you find assets with a certain default gateway address.
Example
Show assets with this default gateway address
interfaces.gatewayAddress: 10.11.65.1
interfaces.hostnameinterfaces.hostname
Find the hostname you're looking for. Search by domain name, use backticks for exact matching, or enter a partial value with an asterisk (*) for suffix/prefix matching.
Examples
Show any findings related to name
interfaces.hostname: xpsp2-jp-26-111
Show any findings related to name (we'll match super domains)
interfaces.hostname: com-pa3020-36.eng.sjc01.qualys.com
Show any findings that match exact value
interfaces.hostname: `xpsp2-jp-26-111`
interfaces.hostname: `com-pa3020-36.eng.sjc01.qualys.com`
Show any findings that match domain name
interfaces.hostname: qualys.com
interfaces.hostname: sjc01.qualys.com
interfaces.hostname: eng.sjc01.qualys.com
Show any findings starting with string (case sensitive)
interfaces.hostname: xp*
interfaces.hostname: com-pa30*
Show any findings ending with string
interfaces.hostname: *111
interfaces.hostname: *lys.com
interfaces.interfaceNameinterfaces.interfaceName
Use a text value ##### to help you find a certain interface name.
Example
Show the asset with name PRO/1000
interfaces.interfaceName: PRO/1000
interfaces.macAddressinterfaces.macAddress
Use values within quotes to help you find a MAC address you're interested in.
Example
Show the asset with this MAC address
interfaces.macAddress: "00-50-56-A9-73-5A"
lastActivitylastActivity
Use a date range or specific date to define when the last activity on the agent occurred. Last activity could be when agent was last scanned, updated, activated, etc.
Examples
Show findings with last activity within certain dates
lastActivity: [2016-01-01 ... 2016-01-10]
Show findings with last activity starting 2015-10-01, ending 1 month ago
lastActivity: [2015-10-01 ... now-1M]
Show findings with last activity starting 2 weeks ago, ending 1 second ago
lastActivity: [now-2w ... now-1s]
Show findings with last activity on a specific date
lastActivity:'2015-12-01'
lastCheckedInlastCheckedIn
Use a date range or specific date to define when agents last checked in to the platform.
Examples
Show findings with last check in within a specific date range
lastCheckedIn:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
lastCheckedIn:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago
lastCheckedIn:[now-2w ... now-1s]
Show findings with last check in on a specific date
lastCheckedIn:'2020-02-11'
Show findings with last check in before (older than) last 30 days.
lastCheckedIn<now-30d
Note: In this case, we recommend not to use the NOT operator in your range search to form a query like NOT lastCheckedIn:[now-30d...now-2s]. See 'Say no to NO' section in the 'QQL Best Practices' topic in the Unified Dashboard online Help.
Show findings with last check in within last 30 days excluding day 30
lastCheckedIn>now-30d
Show findings with last check in within last 30 days including day 30
lastCheckedIn>=now-30d
Show findings with last check in which is older than last 30 days excluding day 30
lastCheckedIn<now-30d
Show findings with last check in which is older than last 30 days including day 30
lastCheckedIn<=now-30d
lastComplianceScanDatelastComplianceScanDate
Use a date range or specific date to define when compliance scans were last conducted.
Examples
Show findings with last compliance scan within certain dates
lastComplianceScanDate: [2017-01-01 ... 2017-03-31]
Show findings with last compliance scan starting 2016-10-15, ending 1 month ago
lastComplianceScanDate: [2016-10-15 ... now-1M]
Show findings with last compliance scan starting 2 weeks ago, ending 1 second ago
lastComplianceScanDate: [now-2w ... now-1s]
Show findings with last compliance scan on specific date
lastComplianceScanDate:'2017-02-18'
lastFullScanlastFullScan
Use a date range or specific date to define when full scans (assessments) were last conducted using Cloud Agent (CA).
Examples
Show findings with last full scan within certain dates
lastFullScan: [2016-01-01 ... 2016-01-10]
Show findings with last full scan starting 2015-10-01, ending 1 month ago
lastFullScan: [2015-10-01 ... now-1M]
Show findings with last full scan starting 2 weeks ago, ending 1 second ago
lastFullScan: [now-2w ... now-1s]
Show findings with last full scan on a specific date
lastFullScan:'2016-02-08'
lastInventorylastInventory
Use a date range or specific date to define when inventory scans were last conducted by agents. We recommend lastInventoryDate for date range queries using parameters i.e. [now-1M ... now-1s]
Examples
Show findings with last inventory scan within certain dates
lastInventory: [2018-06-01 ... 2018-06-10]
Show findings with last inventory scan on specific date
lastInventory:'2018-07-25'
lastInventoryDatelastInventoryDate
Use a date range or specific date to define when inventory scans were last conducted by agents. We recommend lastInventoryDate for date range queries using parameters i.e. [now-1M ... now-1s]
Examples
Show findings with last inventory scan within certain dates
lastInventoryDate: [2018-05-01 ... 2018-06-28]
Show findings with last inventory scan starting 2018-06-15, ending 1 month ago
lastInventoryDate: [2018-06-15 ... now-1M]
Show findings with last inventory scan starting 3 weeks ago, ending 1 second ago
lastInventoryDate: [now-3w ... now-1s]
Show findings with last inventory scan on specific date
lastInventoryDate:'2018-07-10'
lastLoggedOnUserlastLoggedOnUser
Use a text value ##### to help you find assets last logged into by a user of interest.
Examples
Show assets with last logon by user asmith
lastLoggedOnUser: asmith
lastVmScanDatelastVmScanDate
Use a date range or specific date to define when vulnerability scans were last conducted.
Examples
Show findings with last vulnerability scan within certain dates
lastVmScanDate: [2017-01-01 ... 2017-02-10]
Show findings with last vulnerability scan starting 2016-11-01, ending 1 month ago
lastVmScanDate: [2016-11-01 ... now-1M]
Show findings with last vulnerability scan starting 2 weeks ago, ending 1 second ago
lastVmScanDate: [now-2w ... now-1s]
Show findings with last vulnerability scan on specific date
lastVmScanDate:'2017-04-10'
namename
Use values within quotes or backticks to help you find the asset name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to name
name: QK2K12QP3-65-53
Show any findings that match exact value
name: `QK2K12QP3-65-53`
netbiosNamenetbiosName
Use a text value ##### to define the NetBIOS name you're interested in.
Examples
Show assets with this exact name (case sensitive)
netbiosName: EC2AMAZ-19OC2IT
Show assets with name starting with "EC2" (case sensitive)
netbiosName: EC2
Show assets with name ending with "c2it" (case insensitive)
netbiosName: *c2it
openPorts.descriptionopenPorts.description
Use values within quotes or backticks to help you find the service description detected on an open port. Quotes can be used when the value has more than one word.
Examples
Show any findings with this description
openPorts.description: Windows Remote Desktop
Show any findings that contain parts of description
openPorts.description: "Windows Remote Desktop"
Show any findings that match exact value
openPorts.description: `Windows Remote Desktop`
openPorts.detectedServiceopenPorts.detectedService
Use values within quotes or backticks to help you find the detected service you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this service name
openPorts.detectedService: win_remote_desktop
Show any findings that match exact value
openPorts.detectedService: `win_remote_desktop`
openPorts.firstFoundopenPorts.firstFound
Use a date range or specific date to define when open ports were first found.
Examples
Show findings with open ports first found within certain dates
openPorts.firstFound: [2017-06-15 ... 2017-06-30]
Show findings with open ports first found starting 2017-06-22, ending 1 month ago
openPorts.firstFound: [2017-06-22 ... now-1M]
Show findings with open ports first found starting 2 weeks ago, ending 1 second ago
openPorts.firstFound: [now-2w ... now-1s]
Show findings with open ports first found on specific date
openPorts.firstFound:'2017-06-14'
openPorts.lastUpdatedopenPorts.lastUpdated
Use a date range or specific date to define when open ports were last updated.
Examples
Show findings with open ports last updated within certain dates
openPorts.lastUpdated: [2017-06-15 ... 2017-06-30]
Show findings with open ports last updated starting 2017-06-22, ending 1 month ago
openPorts.lastUpdated: [2017-06-22 ... now-1M]
Show findings with open ports last updated starting 2 weeks ago, ending 1 second ago
openPorts.lastUpdated: [now-2w ... now-1s]
Show findings with open ports last updated on specific date
openPorts.lastUpdated:'2017-06-14'
openPorts.portopenPorts.port
Use an integer value ##### to help you find assets with some open port.
Example
Show assets with open port 80
openPorts.port: 80
openPorts.protocolopenPorts.protocol
Use a text value ##### (UDP or TCP) to define the port protocol you're interested in.
Examples
Show findings found on TCP
openPorts.protocol: TCP
Show findings found on port 80 and TCP
openPorts: (port: 80 AND protocol: TCP)
pendingActivationForModulespendingActivationForModules
Select the name ##### of a module that's pending activation. Select from names in the drop-down menu.
Examples
Show assets pending activation for VM
pendingActivationForModules: "VM"
Show assets pending activation for VM and FIM
pendingActivationForModules: "VM" AND pendingActivationForModules: "FIM"
processors.descriptionprocessors.description
Use values within quotes or backticks to help you find the processor description you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this description
processors.description: intel
Show any findings that match exact value
processors.description: `intel`
processors.speedprocessors.speed
Use an integer value ##### to help you find assets with a certain processor speed.
Example
Show assets with this processor speed
processors.speed: 1995
providerprovider
Select the name ##### of a cloud service provider you're looking for. Select from names in the drop-down menu.
Examples
Show assets synced from Amazon AWS
provider: "AWS"
services.descriptionservices.description
Use values within quotes or backticks to help you find the service description you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this description
services.description: Windows Event Log
Show any findings that contain parts of description
services.description: "Windows Event Log"
Show any findings that match exact value
services.description: `Windows Event Log`
services.nameservices.name
Use values within quotes or backticks to help you find the service name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
services.name: eventlog
Show any findings that match exact value
services.name: `eventlog`
services.statusservices.status
Use values within quotes or backticks to help you find the service status you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this status
services.status: running
Show any findings that match exact value
services.status: `running`
software.firstFoundsoftware.firstFound
Use a date range or specific date to define when software was first found.
Examples
Show assets with software first found within certain dates
software.firstFound: [2017-06-15 ... 2017-06-30]
Show assets with software first found starting 2017-06-22, ending 1 month ago
software.firstFound: [2017-06-22 ... now-1M]
Show assets with software first found starting 2 weeks ago, ending 1 second ago
software.firstFound: [now-2w ... now-1s]
Show assets with software first found on specific date
software.firstFound:'2017-06-14'
software.lastUpdatedsoftware.lastUpdated
Use a date range or specific date to define when software was last updated.
Examples
Show assets with software last updated within certain dates
software.lastUpdated: [2017-06-15 ... 2017-06-30]
Show assets with software last updated starting 2017-06-22, ending 1 month ago
software.lastUpdated: [2017-06-22 ... now-1M]
Show assets with software last updated starting 2 weeks ago, ending 1 second ago
software.lastUpdated: [now-2w ... now-1s]
Show assets with software last updated on specific date
software.lastUpdated:'2017-06-14'
software.installedDatesoftware.installedDate
Use a date range or specific date to define when software was installed.
Examples
Show assets with software installed within certain dates
software.installedDate:[2018-01-15 ... 2018-03-12]
Show assets with software installed starting 2018-01-22, ending 1 month ago
software.installedDate:[2018-01-22 ... now-1M]
Show assets with software installed starting 2 weeks ago, ending 1 second ago
software.installedDate:[now-2w ... now-1s]
Show assets with software installed on specific date
software.installedDate:'2018-02-16'
software.namesoftware.name
Use values within quotes or backticks to help you find the software name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
software.name: VMware Tools
Show any findings that contain parts of name
software.name: "VMware Tools"
Show any findings that match exact value
software.name: `VMware Tools`
Find assets with certain tag and software installed
tags.name: `Cloud Agent` AND software: (name: `Cisco AnyConnect Secure Mobility Client` AND version: `3.1.12345`)
software.versionsoftware.version
Use a text value ##### to define the software version you're interested in. Note that you cannot perform a range search since this is a text field.
Example
Show findings with this version
software.version: 8.6.10
Find assets with certain tag and software installed
tags.name: `Cloud Agent` AND software: (name: `Cisco AnyConnect Secure Mobility Client` AND version: `3.1.12345`)
system.biosDescriptionsystem.biosDescription
Use values within quotes or backticks to help you find the BIOS description you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this description
system.biosDescription: Phoenix Technologies
Show any findings that contain parts of name
system.biosDescription: "Phoenix Technologies"
Show any findings that match exact value
system.biosDescription: `Phoenix Technologies`
system.lastBootsystem.lastBoot
Use a date range or specific date to define when assets were last booted.
Examples
Show assets last booted within certain dates
system.lastBoot: [2016-01-01 ... 2016-01-10]
Show assets last booted starting 2015-10-01, ending 1 month ago
system.lastBoot: [2015-10-01 ... now-1M]
Show assets last booted starting 2 weeks ago, ending 1 second ago
system.lastBoot: [now-2w ... now-1s]
Show assets last booted on a specific date
system.lastBoot:'2016-01-08'
system.manufacturersystem.manufacturer
Use values within quotes or backticks to help you find the system manufacturer you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
system.manufacturer: dell
Show any findings that match exact value
system.manufacturer: `dell`
system.modelsystem.model
Use values within quotes or backticks to help you find the system model you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
system.model: optiplex
Show any findings that match exact value
system.model: `optiplex`
system.timezonesystem.timezone
Use a text value ##### in quotes to find assets with a certain timezone set.
Example
Show assets with this timezone
system.timezone: "-08:00"
system.totalMemorysystem.totalMemory
Use an integer value ##### to help you find assets with a certain total system memory.
Example
Show assets with this total system memory
system.totalMemory: 1024
udcManifestAssignedudcManifestAssigned
Use the values true | false to find assets with PC agents assigned a UDC manifest. Assets are found when agents have the PC module enabled and one or more user defined controls have been added to your subscription.
Examples
Show assets with agents assigned a UDC manfest
udcManifestAssigned: "true"
Show assets with agents not assigned a UDC manifest
udcManifestAssigned: "false"
updatedupdated
Use a date range or specific date to define when assets were updated (i.e. when re-scanned by a scanner appliance, or when host data uploaded to the cloud platform by an agent).
Examples
Show assets updated within certain dates
updated: [2016-01-01 ... 2016-01-10]
Show assets updated starting 2015-10-01, ending 3 months ago
updated: [2015-10-01 ... now-3M]
Show assets updated starting 2 weeks ago, ending 1 second ago
updated: [now-2w ... now-1s]
Show assets updated on a specific date
updated:'2016-01-10'
volumes.freevolumes.free
Use an integer value ##### to help you find assets with a certain free volume space.
Example
Show assets with this free volume space
volumes.free: 448312320
volumes.namevolumes.name
Use a text value ##### to find assets with a certain volume name.
Example
Show assets with this volume name
volumes.name: /boot
volumes.sizevolumes.size
Use an integer value ##### to help you find assets with a certain volume size.
Example
Show assets with this volume size
volumes.size: 481529856
vulnerabilitiesvulnerabilities
Choose the value * to find assets with vulnerabilities.
Example
Show all findings that have vulnerabilities
vulnerabilities: *
vulnerabilities.firstFoundvulnerabilities.firstFound
Use a date range or specific date to define when findings were first found.
Examples
Show findings first found within certain dates
vulnerabilities.firstFound: [2015-10-21 ... 2015-10-30]
Show findings first found starting 2015-10-01, ending 1 month ago
vulnerabilities.firstFound: [2015-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
vulnerabilities.firstFound: [now-2w ... now-1s]
Show findings first found on certain date
vulnerabilities.firstFound:'2015-11-11'
vulnerabilities.lastFoundvulnerabilities.lastFound
Use a date range or specific date to define when findings were last found.
Examples
Show findings last found within certain dates
vulnerabilities.lastFound: [2015-10-21 ... 2016-01-15]
Show findings last found starting 2016-01-01, ending 1 month ago
vulnerabilities.lastFound: [2016-01-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFound: [now-2w ... now-1s]
Show findings last found on certain date
vulnerabilities.lastFound:'2016-01-11'
Show findings last found on 2017-01-12 with patch available
vulnerabilities: (lastFound: '2017-01-12' AND vulnerability.patchAvailable: "true")
vulnerabilities.typeDetectedvulnerabilities.typeDetected
Select a detection type (e.g. Confirmed, Potential, Information) to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
Example
Show findings with this type
vulnerabilities.typeDetected: "Confirmed"
vulnerabilities.vulnerability.authTypesvulnerabilities.vulnerability.authTypes
Select the name (WINDOWS_AUTH, UNIX_AUTH, ORACLE_AUTH, etc) of an authentication type you're interested in. Select from names in the drop-down menu.
Example
Show findings with Windows auth type
vulnerabilities.vulnerability.authTypes: "WINDOWS_AUTH"
vulnerabilities.vulnerability.bugTraqIdsvulnerabilities.vulnerability.bugTraqIds
Use a text value ##### to find a BugTraq number you're interested in.
Example
Show findings with BugTraq ID 22211
vulnerabilities.vulnerability.bugTraqIds: 22211
vulnerabilities.vulnerability.categoryvulnerabilities.vulnerability.category
Select a category (CGI, Database, DNS, BIND, etc) to find vulnerabilities with this category. Select from names in the drop-down menu.
Example
Show findings with the category CGI
vulnerabilities.vulnerability.category: "CGI"
vulnerabilities.vulnerability.compliance.descriptionvulnerabilities.vulnerability.compliance.description
Use values within quotes or backticks to help you find the compliance description you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to this description
vulnerabilities.vulnerability.compliance.description: malicious software
Show any findings that contain "malicious" or "software" in description
vulnerabilities.vulnerability.compliance.description: "malicious software"
Show any findings that match exact value
vulnerabilities.vulnerability.compliance.description: `malicious software`
vulnerabilities.vulnerability.compliance.sectionvulnerabilities.vulnerability.compliance.section
Use values within quotes or backticks to help you find the compliance section you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to this section
vulnerabilities.vulnerability.compliance.section: 164.308
Show any findings that match exact value
vulnerabilities.vulnerability.compliance.section: `164.308`
vulnerabilities.vulnerability.compliance.typevulnerabilities.vulnerability.compliance.type
Select the name ##### of a compliance type you're interested in (e.g. COBIT, HIPAA, GLBA, SOX). Select from names in the drop-down menu.
Example
Show findings with the compliance type HIPAA
vulnerabilities.vulnerability.compliance.type: "HIPAA"
vulnerabilities.vulnerability.consequencevulnerabilities.vulnerability.consequence
Use values within quotes or backticks to help you find the consequence you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to consequence
vulnerabilities.vulnerability.consequence: sensitive information
Show any findings that contain "sensitive" or "information" in consequence
vulnerabilities.vulnerability.consequence: "sensitive information"
Show any findings that match exact value
vulnerabilities.vulnerability.consequence: `sensitive information`
vulnerabilities.vulnerability.cveIdsvulnerabilities.vulnerability.cveIds
Use a text value ##### to find the CVE name you're interested in.
Example
Show findings with CVE name CVE-2015-0313
vulnerabilities.vulnerability.cveIds: CVE-2015-0313
vulnerabilities.vulnerability.cvssInfo.accessVectorvulnerabilities.vulnerability.cvssInfo.accessVector
Select the name ##### of a CVSS access vector you'd like to find (e.g. UNDEFINED, LOCAL_ACCESS, ADJACENT_NETWORK, NETWORK). Select from names in the drop-down menu.
Example
Show findings with this name
vulnerabilities.vulnerability.cvssInfo.accessVector: "NETWORK"
vulnerabilities.vulnerability.cvssInfo.baseScorevulnerabilities.vulnerability.cvssInfo.baseScore
Use an integer value ##### to help you find the CVSS base score you're interested in.
Example
Show assets with this score
vulnerabilities.vulnerability.cvssInfo.baseScore: 7.8
vulnerabilities.vulnerability.cvssInfo.temporalScorevulnerabilities.vulnerability.cvssInfo.temporalScore
Use an integer value ##### to help you find the CVSS temporal score you're interested in.
Example
Show assets with this score
vulnerabilities.vulnerability.cvssInfo.temporalScore: 6.4
vulnerabilities.vulnerability.descriptionvulnerabilities.vulnerability.description
Use values within quotes or backticks to help you find the vulnerability description you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to description
vulnerabilities.vulnerability.description: remote code execution
Show any findings that contain "remote" or "code" in description
vulnerabilities.vulnerability.description: "remote code execution"
Show any findings that match exact value
vulnerabilities.vulnerability.description: `remote code execution`
vulnerabilities.vulnerability.discoveryTypesvulnerabilities.vulnerability.discoveryTypes
Select a discovery type (Remote or Authenticated) to find assets with vulnerabilities having this discovery type. Select from names in the drop-down menu.
Example
Show findings with Remote discovery type
vulnerabilities.vulnerability.discoveryTypes: Remote
vulnerabilities.vulnerability.exploitabilityvulnerabilities.vulnerability.exploitability
Use values within quotes or backticks to help you find known exploit description you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to this description
vulnerabilities.vulnerability.exploitability: GIF Parser Heap
Show any findings that contain "GIF", "Parser" or "Heap" in description
vulnerabilities.vulnerability.exploitability: "GIF Parser Heap"
Show any findings that match exact value
vulnerabilities.vulnerability.exploitability: `GIF Parser Heap`
vulnerabilities.vulnerability.flagsvulnerabilities.vulnerability.flags
Use a text value ##### to find the Qualys defined vulnerability property of interest (e.g. REMOTE, WINDOWS_AUTH, UNIX_AUTH etc, PCI_RELATED).
Example
Show findings with this property
vulnerabilities.vulnerability.flags: PCI_RELATED
vulnerabilities.vulnerability.listsvulnerabilities.vulnerability.lists
Use a text value ##### to find the vulnerability list of interest (e.g. SANS_20, QUALYS_20, QUALYS_INT_10, QUALYS_EXT_10).
Example
Show findings with vulnerabilities in SANS Top 20
vulnerabilities.vulnerability.lists: SANS_20
vulnerabilities.vulnerability.osvulnerabilities.vulnerability.os
Use values within quotes or backticks to help you find the operating system vulnerabilities were detected on. Quotes can be used when the value has more than one word.
Examples
Show any findings related to this OS value
vulnerabilities.vulnerability.os: windows
Show any findings that match exact value
vulnerabilities.vulnerability.os: `windows`
vulnerabilities.vulnerability.patchAvailablevulnerabilities.vulnerability.patchAvailable
Use the values true | false to define vulnerabilities with patch available.
Examples
Show findings with patch available
vulnerabilities.vulnerability.patchAvailable: "true"
Show findings with no patch available
vulnerabilities.vulnerability.patchAvailable: "false"
vulnerabilities.vulnerability.patchesvulnerabilities.vulnerability.patches
Use an integer value ##### to help you find the patch QID you're interested in.
Example
Show assets with this patch QID
vulnerabilities.vulnerability.patches: 90753
vulnerabilities.vulnerability.publishedvulnerabilities.vulnerability.published
Use a date range or specific date to define when vulnerabilities were first published in the KnowledgeBase.
Examples
Show findings for vulnerabilities published within certain dates
vulnerabilities.vulnerability.published: [2015-10-21 ... 2016-01-15]
Show findings for vulnerabilities published starting 2016-01-01, ending 1 month ago
vulnerabilities.vulnerability.published: [2016-01-01 ... now-1M]
Show findings for vulnerabilities published starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.published: [now-2w ... now-1s]
Show findings for vulnerabilities published on certain date
vulnerabilities.vulnerability.published:'2015-07-15'
vulnerabilities.vulnerability.qidvulnerabilities.vulnerability.qid
Use an integer value ##### to define the QID in question.
Example
Show findings with QID 90405
vulnerabilities.vulnerability.qid: 90405
vulnerabilities.vulnerability.riskvulnerabilities.vulnerability.risk
Use an integer value ##### to define the vulnerability risk rating you're interested in. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
vulnerabilities.vulnerability.risk: 50
vulnerabilities.vulnerability.sans20Categoriesvulnerabilities.vulnerability.sans20Categories
Use a text value ##### to find vulnerabilities in the SANS 20 category you're interested in (e.g. Anti-virus Software, Backup Software, etc).
Example
Show findings with this category name
vulnerabilities.vulnerability.sans20Categories: "Media Players"
vulnerabilities.severityvulnerabilities.severity
Select a severity (1-5) to find assets having vulnerabilities with this severity. Select from values in the drop-down menu.
Example
Show findings with severity 4
vulnerabilities.severity: "4"
vulnerabilities.vulnerability.solutionvulnerabilities.vulnerability.solution
Use values within quotes or backticks to help you find the solution you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to this solution
vulnerabilities.vulnerability.solution: Bulletin MS10-006
Show any findings that contain parts of solution
vulnerabilities.vulnerability.solution: "Bulletin MS10-006"
Show any findings that match exact value
vulnerabilities.vulnerability.solution: `Bulletin MS10-006`
vulnerabilities.vulnerability.titlevulnerabilities.vulnerability.title
Use values within quotes or backticks to help you find the title you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings related to this title
vulnerabilities.vulnerability.title: Remote Code Execution
Show any findings that contain "Remote" or "Code" in title
vulnerabilities.vulnerability.title: "Remote Code"
Show any findings that match exact value
vulnerabilities.vulnerability.title: `Remote Code`
vulnerabilities.vulnerability.typesvulnerabilities.vulnerability.types
Select a detection type (e.g. Vulnerability, Potential, Information) to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
Example
Show findings with this type
vulnerabilities.vulnerability.types: "VULNERABILITY"
vulnerabilities.vulnerability.updatedvulnerabilities.vulnerability.updated
Use a date range or specific date to define when vulnerabilities were updated in the KnowledgeBase.
Examples
Show vulnerabilities updated within certain dates
vulnerabilities.vulnerability.updated: [2015-10-21 ... 2015-10-30]
Show vulnerabilities updated starting 2015-11-01, ending 1 month ago
vulnerabilities.vulnerability.updated: [2015-11-01 ... now-1M]
Show vulnerabilities updated stating 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.updated: [now-2w ... now-1s]
Show vulnerabilities updated on certain date
vulnerabilities.vulnerability.updated: '2015-03-08'
vulnerabilities.vulnerability.vendorRefsvulnerabilities.vulnerability.vendorRefs
Use a text value ##### to find the vendor reference you're interested in.
Example
Show findings with this reference
vulnerabilities.vulnerability.vendorRefs: KB3021953
andand
Use a boolean query to express your query using AND logic.
Example
Show assets with operating system Windows and Linux
operatingSystem: windows and operatingSystem: linux
notnot
Use a boolean query to express your query using NOT logic.
Example
Show assets that don't have Windows operating system
not operatingSystem: windows
oror
Use a boolean query to express your query using OR logic.
Example
Show assets with one of these tag names
tag.name: Cloud Agent or tag.name: HQ
Threat Protection
(For Threat Protection users) Use these tokens for searching Real-Time Threat Indicators (RTI).
vulnerabilities.vulnerability.threatIntel.activeAttacksvulnerabilities.vulnerability.threatIntel.activeAttacks
Use the values true | false to define real-time threats due to active attacks.
Example
Show assets with threats due to active attacks
vulnerabilities.vulnerability.threatIntel.activeAttacks: "true"
vulnerabilities.vulnerability.threatIntel.denialOfServicevulnerabilities.vulnerability.threatIntel.denialOfService
Use the values true | false to define real-time threats due to denial of service.
Example
Show assets with threats due to denial of service
vulnerabilities.vulnerability.threatIntel.denialOfService: "true"
vulnerabilities.vulnerability.threatIntel.easyExploitvulnerabilities.vulnerability.threatIntel.easyExploit
Use the values true | false to define real-time threats due to easy exploit.
Example
Show assets with threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.easyExploit: "true"
vulnerabilities.vulnerability.threatIntel.exploitKitvulnerabilities.vulnerability.threatIntel.exploitKit
Use the values true | false to define real-time threats due to exploit kit.
Example
Show assets with threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit: "true"
vulnerabilities.vulnerability.threatIntel.exploitKitNamevulnerabilities.vulnerability.threatIntel.exploitKitName
Use values within quotes or backticks to help you find the exploit kit name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.exploitKitName: Angler
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.exploitKitName: `Angler`
vulnerabilities.vulnerability.threatIntel.highDataLossvulnerabilities.vulnerability.threatIntel.highDataLoss
Use the values true | false to define real-time threats due to high data loss.
Example
Show assets with threats due to high data loss
vulnerabilities.vulnerability.threatIntel.highDataLoss: "true"
vulnerabilities.vulnerability.threatIntel.highLateralMovementvulnerabilities.vulnerability.threatIntel.highLateralMovement
Use the values true | false to define real-time threats due to high lateral movement.
Example
Show assets with threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.highLateralMovement: "true"
vulnerabilities.vulnerability.threatIntel.malwarevulnerabilities.vulnerability.threatIntel.malware
Use the values true | false to define real-time threats due to malware.
Example
Show assets with threats due to malware
vulnerabilities.vulnerability.threatIntel.malware: "true"
vulnerabilities.vulnerability.threatIntel.malwareNamevulnerabilities.vulnerability.threatIntel.malwareName
Use values within quotes or backticks to help you find the malware name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.malwareName: TROJ_PDFKA.DQ
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.malwareName: `TROJ_PDFKA.DQ`
vulnerabilities.vulnerability.threatIntel.noPatchvulnerabilities.vulnerability.threatIntel.noPatch
Use the values true | false to define real-time threats due to no patch available.
Example
Show assets with threats due to no patch available
vulnerabilities.vulnerability.threatIntel.noPatch: "true"
vulnerabilities.vulnerability.threatIntel.publicExploitvulnerabilities.vulnerability.threatIntel.publicExploit
Use the values true | false to define real-time threats due to public exploit.
Example
Show assets with threats due to public exploit
vulnerabilities.vulnerability.threatIntel.publicExploit: "true"
vulnerabilities.vulnerability.threatIntel.publicExploitNamevulnerabilities.vulnerability.threatIntel.publicExploitName
Use values within quotes or backticks to help you find the public exploit name of interest. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.publicExploitName: RealVNC NULL Authentication Mode Bypass
Show any findings that contain parts of name
vulnerabilities.vulnerability.threatIntel.publicExploitName: "RealVNC NULL Authentication Mode Bypass"
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.publicExploitName: `RealVNC NULL Authentication Mode Bypass`
vulnerabilities.vulnerability.threatIntel.zeroDayvulnerabilities.vulnerability.threatIntel.zeroDay
Use the values true | false to define real-time threats due to zero day exploit.
Example
Show assets with threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.zeroDay: "true"