Syntax help displayed in UI for tokens. Click each token to learn more about it.
Note: For all the date-related tokens, the date search is evaluated only for UTC format. The actual search results might show you the date as per your time zone.
Asset Inventory and Passive Sensor | AWS EC2 | Microsoft Azure | Google Cloud Platform | Oracle Cloud Infrastructure | IBM Cloud |Passive Sensor only
Example
Show findings with username administrator
accounts.username:"administrator"
Example
Show assets with agents activated using this key
agent.activations.key: "057cc48a-8d84-48eb-add4-97a605d0567d"
Example
Show assets with active agents
agent.activations.status: ACTIVE
Examples
Show assets already activated for VM
asset.activatedForModules:VM
Show assets already activated for VM or PC
asset.activatedForModules:[VM, PC]
Example
Show findings with this agent ID
asset.agentID:"0fc8e682-e9cc-4e7d-b92a-0c905d81ec74"
Examples
Show any findings related to profile name
agent.configurationProfile: Initial Profile
Show any findings that contain parts of the name
agent.configurationProfile: "Initial Profile"
Show any findings that match exact value
agent.configurationProfile: `Initial Profile`
Example
Show findings for an external IP address that an agent connected from
agent.connectedFrom: 10.0.100.11
Example
Show assets that host containers
asset.isContainerHost: "true"
Examples
Show last agent activity within certain dates
agent.lastActivity:[2019-01-01 ... 2019-01-15]
Show last agent activity starting 2019-01-15, ending 1 month ago
agent.lastActivity:[2019-01-15 ... now-1M]
Show last agent activity starting 2 weeks ago, ending 1 second ago
agent.lastActivity:[now-2w ... now-1s]
Show last agent activity on a specific date
agent.lastActivity:'2019-03-18'
Examples
Show findings with last check in within a specific date range.
agent.lastCheckedIn:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
agent.lastCheckedIn:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago.
agent.lastCheckedIn:[now-2w ... now-1s]
Show findings with last check in on a specific date
agent.lastCheckedIn:'2020-02-11'
Show findings with last check in before (older than) last 30 days.
agent.lastCheckedIn<now-30d
Note: In this case, we recommend not to use the NOT operator in your range search to form a query like NOT lastCheckedIn:[now-30d...now-2s]. See 'Say no to NO' section in the 'QQL Best Practices' topic in the Unified Dashboard online Help.
Show findings with last check in within last 30 days excluding day 30
agent.lastCheckedIn>now-30d
Show findings with last check in within last 30 days including day 30
agent.lastCheckedIn>=now-30d
Show findings with last check in which is older than last 30 days excluding day 30
agent.lastCheckedIn<now-30d
Show findings with last check in which is older than last 30 days including day 30
agent.lastCheckedIn<=now-30d
Examples
Show last inventory scan within certain dates
agent.lastInventory:[2019-01-01 ... 2019-01-15]
Show last inventory scan starting 2019-01-15, ending 1 month ago
agent.lastInventory:[2019-01-15 ... now-1M]
Show last inventory scan starting 2 weeks ago, ending 1 second ago
agent.lastInventory:[now-2w ... now-1s]
Show last inventory scan on a specific date
agent.lastInventory:'2019-03-18'
Examples
Show assets with agents assigned a UDC manfest
agent.udcManifestAssigned: "true"
Show assets with agents not assigned a UDC manifest
agent.udcManifestAssigned: "false"
Example
Show agents of this version
asset.version:1.3.2.0
Example
Show findings with this agent ID
asset.agentID:12345679
Example
Show findings with this asset ID
asset.assetID:122855563
Examples
Show any findings that contain this BIOS asset tag
asset.biosAssetTag:113632
Show any findings that contain parts of BIOS asset tag
asset.biosAssetTag:"113632"
Show any findings that match exact value
asset.biosAssetTag:`113632`
Examples
Show any findings that contain parts of description
asset.biosDescription:"American Megatrends
Inc."
Show any findings that match exact value "American Megatrends Inc."
asset.biosDescription:`American Megatrends Inc.`
Example
Show findings with this BIOS Serial Number
asset.biosSerialNumber:C02S50JDFVH8
Example
Show assets that have 2 CPUs
asset.cpuCount:2
Examples
Show assets created within certain dates
asset.created:[2019-01-01 ... 2019-01-15]
Show assets created starting 2019-01-15, ending 1 month ago
asset.created:[2019-01-15
... now-1M]
Show assets created starting 2 weeks ago, ending 1 second ago
asset.created:[now-2w ... now-1s]
Show assets created on a specific date
asset.created:'2019-03-18'
Examples
Show assets based on the asset criticality score 1
asset.criticalityScore:`1`
Examples
Show all the assets with a risk score 900
asset.riskScore:900
Show all the assets with risk score between the range 800 to 1000
asset.riskScore:[800 ... 1000]
Show all the assets with a risk score greater than 500
asset.riskScore >500
Show all the assets with a risk score less than or equal to 800
asset.riskScore <=800
Example
Show findings with this bios hardware UUID
asset.biosHardwareUUID:152FBCC6-641B-5661-9E68-DEF35D8C4B51
Example
Show assets having this host ID
asset.hostID:43954857
Examples
Show assets last booted within certain dates
asset.lastBoot:[2019-01-01 ... 2019-01-15]
Show assets last booted starting 2019-01-15, ending 1 month ago
asset.lastBoot:[2019-01-15
... now-1M]
Show assets last booted starting 2 weeks ago, ending 1 second ago
asset.lastBoot:[now-2w ... now-1s]
Show assets last booted on a specific date
asset.lastBoot:'2019-03-18'
Examples
Show assets with last logon by user asmith
asset.lastLoggedOnUser:asmith
Examples
Show assets last updated within certain dates
asset.lastUpdated:[2019-01-01 ... 2019-01-15]
Show assets last updated starting 2019-01-15, ending 1 month ago
asset.lastUpdated:[2019-01-15
... now-1M]
Show assets last updated starting 2 weeks ago, ending 1 second ago
asset.lastUpdated:[now-2w ... now-1s]
Show assets last updated on a specific date
asset.lastUpdated:'2019-03-18'
Examples
Show any findings that match the beginning of any substrings within the asset name
asset.name:"ACMENVT7"
Show any findings that match exact value "ACMENVT7"
asset.name:`ACMENVT7`
Examples
Show the asset with this name
asset.netbiosName:ACMENVT7
Example
Show assets with this timezone
asset.timezone:"-08:00"
Example
Show findings with total system memory greater than 900 MB
asset.totalMemory>900
Show findings with total system memory greater than or equal to 900 MB
asset.totalMemory>=900
Show findings with total system memory less than 300 MB
asset.totalMemory<300
Show findings with total system memory less than or equal to 300 MB
asset.totalMemory<=300
Example
Find assets with this tracking method
asset.trackingMethod: QAGENT
Examples
Show any findings that contain parts of name
asset.domainRole:"Member Ser"
Show any findings that match exact value "Member Server"
asset.domainRole:`Member Server`
Example
Find assets of type hypervisor
asset.type: hypervisor
Example
Show assets with last location as Redwood City, California - United States
asset.lastLocation: 'Redwood City, California
- United States'
Example
Show assets with last location with exact string
asset.lastLocation: `Redwood City, California
- United States`
Example
Show assets with last location continent as North America
asset.lastLocation.continent: North America
Example
Show assets with last location country as United States
asset.lastLocation.country: United States
Example
Show assets with last location state as California
asset.lastLocation.state: California
Example
Show assets with assigned location city as Miami
asset.lastLocation.city: Miami
Example
Show assets with last location postal as 94065
asset.lastLocation.postal: 94065
Example
Show assets with operational status as Repair
asset.operationalStatus: Repair
Example
Show assets with environment as Production
asset.environment: Production
Examples
Show any findings that contain parts of name
asset.ownedBy:"Joey"
Show any findings that match exact value "Joey Bolick"
asset.ownedBy:`Joey Bolick`
Examples
Show any findings that contain parts of name
asset.managedBy:"Byron"
Show any findings that match exact value "Byron Fortuna"
asset.managedBy:`Byron Fortuna`
Examples
Show any findings that contain parts of name
asset.supportedBy:"John"
Show any findings that match exact value "John Doe"
asset.supportedBy:`John Doe`
Examples
Show any findings that contain parts of name
asset.supportGroup:"Compliance"
Show any findings that match exact value "Compliance Managers"
asset.supportGroup:`Compliance Managers`
Example
Show assets with company as Qualys
asset.org.company: Qualys
Example
Show assets with department as Development
asset.org.department: Development
Examples
Show any findings that contain parts of name
asset.assignedLocation.name:"401 Biscayne
St, Miami"
Show any findings that match exact value "401 Biscayne St, Miami FL"
asset.assignedLocation.name:`401 Biscayne St,
Miami FL`
Example
Show assets with assigned location city as Miami
asset.assignedLocation.city: Miami
Example
Show assets with assigned location state as FL
asset.assignedLocation.state: FL
asset.assignedLocation.country
Example
Show assets with assigned location country as USA
asset.assignedLocation.country: USA
Examples
Show any findings that contain parts of name
businessApp:(name:"HR")
Show any findings that match exact value "HR Intranet"
businessApp:(name:`HR Intranet`)
Example
Show findings with business app ID as APP007
businessApp:(id:APP007)
Example
Show business applications with operational status as Installed
businessApp:(operationalStatus: Installed)
businessApp.businessCriticality
Examples
Show any findings that contain parts of name
businessApp:(businessCriticality:"1 - most")
Show any findings that match exact value "1 - most critical"
businessApp:(businessCriticality:`1 - most critical`)
Example
Show assets with business application environment as Production
businessApp:(environment: Production)
Examples
Show any findings that contain parts of name
businessApp:(ownedBy:"Joey")
Show any findings that match exact value "Joey Bolick"
businessApp:(ownedBy:`Joey Bolick`)
Examples
Show any findings that contain parts of name
businessApp:(managedBy:"Byron")
Show any findings that match exact value "Byron Fortuna"
businessApp:(managedBy:`Byron Fortuna`)
Examples
Show any findings that contain parts of name
businessApp:(supportedBy:"John")
Show any findings that match exact value "John Doe"
businessApp:(supportedBy:`John Doe`)
Example
Show assets with business application support group as Security
businessApp:(supportGroup: Security)
Examples
Show assets with this correlation ID
qualysCorrelationID: 0f1b031712682e27cca306e4a2a9e3144696ac099b08fcdf76ccb6f3647ec058
Show assets without any correlation ID
qualysCorrelationID: UNIDENTIFIED
Show all assets with correlation ID
qualysCorrelationID: *
Example
Show findings detected by connector name myec2
connectors.connector.name: myec2
Example
Find EC2 connectors
connectors.connector.type: EC2
Examples
Show container product
container.product: CONTAINERD
Show container product
container.product: DOCKER
Example
Show containers of this version
container.version:1.6
Example
Show findings with 2 containers
container.noOfContainers:2
Example
Show findings with 5 container images
container.noOfImages:5
Use the values true | false to choose whether to show container hosts that have the Container Sensor installed.
Example
Show container hosts with container sensor installed.
container.hasSensor:"true"
Examples
Show any findings that contain parts of name
hardware:"Dell Latitude e7470"
Show any findings that match exact value
hardware:`Dell Latitude e7470`
Examples
Show any findings that match exact value
hardware.category:Printers/Laser
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category1:Printers
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category2:Laser
Examples
Show findings with hardware GA date in this date range
hardware.lifecycle.ga:[2019-01-01 ... 2019-01-15]
Show findings with hardware GA date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.ga:[2019-01-15 ... now-1M]
Show findings with hardware GA date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.ga:[now-2w ... now-1s]
Show findings with this hardware GA date
hardware.lifecycle.ga:'2019-03-18'
Examples
Show findings with hardware introduction date in this date range
hardware.lifecycle.intro:[2019-01-01 ... 2019-01-15]
Show findings with hardware introduction date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.intro:[2019-01-15 ... now-1M]
Show findings with hardware introduction date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.intro:[now-2w ... now-1s]
Show findings with this hardware introduction date
hardware.lifecycle.intro:'2019-03-18'
Examples
Show findings with hardware End-of-Sale date in this date range
hardware.lifecycle.eos:[2019-01-01 ... 2019-01-15]
Show findings with hardware End-of-Sale date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.eos:[2019-01-15 ... now-1M]
Show findings with hardware End-of-Sale date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.eos:[now-2w ... now-1s]
Show findings with this hardware End-of-Sale date
hardware.lifecycle.eos:'2019-03-18'
Examples
Show findings with hardware obsolete date in this date range
hardware.lifecycle.obs:[2019-01-01 ... 2019-01-15]
Show findings with hardware obsolete date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.obs:[2019-01-15 ... now-1M]
Show findings with hardware obsolete date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.obs:[now-2w ... now-1s]
Show findings with this hardware obsolete date
hardware.lifecycle.obs:'2019-03-18'
Example
Show End-of-Sale hardware
hardware.lifecycle.stage:"EOS"
Example
Show any findings that match exact value "Dell"
hardware.manufacturer:`Dell`
Example
Show any findings that match exact value "e7470"
hardware.model:`De7470`
Example
Show any findings that match exact value "Latitude"
hardware.product:`Latitude`
Examples
Show the exact match of the IP address
interfaces:(address:`10.10.100.20`)
Show any findings that contain parts of the IP address
interfaces:(address:"10.10.100.2")
interfaces:(address: 10.10.100.2)
Example
Show the asset with DNS address 10.0.100.11
interfaces:(dnsAddress:10.0.100.11)
Example
Show assets with this default gateway address
interfaces:(gatewayAddress:10.11.65.1)
Examples
Show any findings related to name
interfaces:(hostname: xpsp2-jp-26-111)
Show any findings that contain parts of name
interfaces:(hostname: "xpsp2-jp-26-111")
Show any findings that match exact value "xpsp2-jp-26-111"
interfaces:(hostname: `xpsp2-jp-26-111`)
Show any findings related to name (we'll match super domains)
interfaces:(hostname: qcentos71sqp3.rdlab.acme.com)
Show any findings that match exact value "qcentos71sqp3.rdlab.acme.com"
interfaces:(hostname: `qcentos71sqp3.rdlab.acme.com`)
Example
Show the asset with name PRO/1000
interfaces:(interfaceName:PRO/1000)
Examples
Show interfaces updated within certain dates
interfaces:(lastUpdated: [2019-01-01 ... 2019-01-15])
Show interfaces updated starting 2019-01-15, ending 3 months ago
interfaces:(lastUpdated: [2019-01-15 ... now-3M])
Show interfaces updated starting 2 weeks ago, ending 1 second ago
interfaces:(lastUpdated: [now-2w ... now-1s])
Show interfaces updated on a specific date
interfaces:(lastUpdated:'2019-03-18')
Example
Show the asset with this MAC address
interfaces:(macAddress:"00-50-56-A9-73-5A")
Example
Show the asset with interface hardware manufacturer
interfaces:(manufacturer:"Apple")
Example
Show the assets with the following netmask
interfaces:(netmask:255.255.255.0)
Examples
Show assets created within certain dates
inventory.created:[2019-01-01 ... 2019-01-15]
Show assets created starting 2019-01-15, ending 1 month ago
inventory.created:[2019-01-15 ... now-1M]
Show assets created starting 2 weeks ago, ending 1 second ago
inventory.created:[now-2w ... now-1s]
Show assets created on specific date
inventory.created:'2019-03-18'
Examples
Show assets updated within certain dates
inventory.lastUpdated: [2019-01-01 ... 2019-01-15]
Show assets updated starting 2019-01-15, ending 3 months ago
inventory.lastUpdated: [2019-01-15 ... now-3M]
Show assets updated starting 2 weeks ago, ending 1 second ago
inventory.lastUpdated: [now-2w ... now-1s]
Show assets updated on a specific date
inventory.lastUpdated:'2019-03-18'
Type
Example
Show this sensor ID
passiveSensor.id:"003687557369:1654660042:3809075:704:1654660042:3809075:704"
Examples
Show assets with sensor location (appliance location label) as SanJose1
passiveSensor.location:"SanJose1"
Examples
Show assets with sensor name as ITCorp-appliance
passiveSensor.name:"ITCorp-appliance"
Example
Show findings from cloud agents
inventory.source:QAGENT
Examples
Show any findings with this description
openPorts:(description: Windows Remote Desktop)
Show any findings that contain parts of description
openPorts:(description: "Windows Remote Desktop")
Show any findings that match exact value "Windows Remote Desktop"
openPorts:(description: `Windows Remote Desktop`)
Examples
Show any findings with this service name
openPorts:(detectedService: win_remote_desktop)
Show any findings that contain parts of name
openPorts:(detectedService: "win_remote_desktop")
Show any findings that match exact value "win_remote_desktop"
openPorts:(detectedService: `win_remote_desktop`)
Examples
Show open ports found within certain dates
openPorts:(firstFound: [2019-01-01 ... 2019-01-15])
Show open ports found starting 2019-01-15, ending 3 months ago
openPorts:(firstFound: [2019-01-15 ... now-3M])
Show open ports found starting 2 weeks ago, ending 1 second ago
openPorts:(firstFound: [now-2w ... now-1s])
Show open ports found on a specific date
openPorts:(firstFound:'2019-03-18')
Examples
Show open ports last updated within certain dates
openPorts:(lastUpdated:[2019-01-01 ... 2019-01-15])
Show open ports last updated starting 2019-01-15, ending 1 month ago
openPorts:(lastUpdated:[2019-01-15 ... now-1M])
Show open ports last updated starting 2 weeks ago, ending 1 second ago
openPorts:(lastUpdated:[now-2w ... now-1s])
Show open ports last updated on a specific date
openPorts:(lastUpdated:'2019-03-18')
Example
Show assets with open port 80
openPorts:(port:80)
Examples
Show findings found on TCP
openPorts:(protocol: TCP)
Show findings found on port 80 and TCP
openPorts:(port: 80 AND protocol: TCP)
Examples
Show any findings that contain components of OS name
operatingSystem:"Windows 7 SP2 Enterprise"
Show any findings that match exact value
operatingSystem:`Windows 7 SP2 Enterprise`
Example
Show any findings that match exact value
operatingSystem.architecture:64-Bit
Example
Show any findings that match exact value
operatingSystem.category:Windows/Embedded
Example
Show any findings that match exact value
If you are searching for assets with Windows Embedded operating system, then category1 is Windows and category2 is Embedded.
operatingSystem.category1:Windows
Example
If you are searching for assets with Windows Embedded operating system, then category1 is Windows and category2 is Embedded.
Show any findings that match exact value
operatingSystem.category2:Embedded
Example
Show any findings that match exact value
operatingSystem.edition:Enterprise
Examples
Show findings with operating system install date in this date range
operatingSystem.installDate:[2019-01-01 ... 2019-01-15]
Show findings with operating system install date starting 2019-01-15, ending 1 month ago
operatingSystem.installDate:[2019-01-15 ... now-1M]
Show findings with operating system install date starting 2 weeks ago, ending 1 second ago
operatingSystem.installDate:[now-2w ... now-1s]
Show findings with this operating system install date
operatingSystem.installDate:'2019-03-18'
Examples
Show findings with OS GA date in this date range
operatingSystem.lifecycle.ga:[2019-01-01 ... 2019-01-15]
Show findings with OS GA date starting 2019-01-15, ending 1 month ago
operatingSystem.lifecycle.ga:[2019-01-15 ... now-1M]
Show findings with OS GA date starting 2 weeks ago, ending 1 second ago
operatingSystem.lifecycle.ga:[now-2w ... now-1s]
Show findings with this OS GA date
operatingSystem.lifecycle.ga:'2019-03-18'
Examples
Show findings with operating system End-of-Life date in this date range
operatingSystem.lifecycle.eol:[2019-01-01 ...
2019-01-15]
Show findings with operating system End-of-Life date starting 2019-01-15, ending 1 month ago
operatingSystem.lifecycle.eol:[2019-01-15 ...
now-1M]
Show findings with operating system End-of-Life date starting 2 weeks ago, ending 1 second ago
operatingSystem.lifecycle.eol:[now-2w ... now-1s]
Show findings with this operating system End-of-Life date
operatingSystem.lifecycle.eol:'2019-03-18'
Examples
Show findings with operating system End-of-Support date in this date range
operatingSystem.lifecycle.eos:[2019-01-01 ...
2019-01-15]
Show findings with operating system End-of-Support date starting 2019-01-15, ending 1 month ago
operatingSystem.lifecycle.eos:[2019-01-15 ...
now-1M]
Show findings with operating system End-of-Support date starting 2 weeks ago, ending 1 second ago
operatingSystem.lifecycle.eos:[now-2w ... now-1s]
Show findings with this operating system End-of-Support date
operatingSystem.lifecycle.eos:'2019-03-18'
operatingSystem.lifecycle.stage
Examples
Show findings having this OS lifecycle stage
operatingSystem.lifecycle.stage:eol
Show findings with OS category Windows and OS lifecycle stage "active"
operatingSystem:(category:Windows AND
lifecycle.stage:eol)
Example
Show any findings that match exact value
operatingSystem.marketVersion:7
Example
Show any findings that match exact value
operatingSystem.name:Windows 10
Example
Show findings with this exact software publisher
operatingSystem.publisher:Microsoft
Example
Show findings with this exact OS update version
operatingSystem.update:SP2
Example
Show findings with this exact OS version
operatingSystem.version:16.1
Examples
Show any findings that contain parts of name
processors:"iIntel Xwon® CPU ES-2673 v3"
Show any findings that match exact value
processors:`Intel Xwon® CPU ES-2673 v3`
Example
Show the number of cores per socket
processors.coresPerSocket:2
processors.multithreadingStatus
Example
Show multi-threading enabled processor
processors.multithreadingStatus: "ENABLED"
Example
Show the logical CPUs
processors.numberOfCpu:4
Example
Show number of sockets
processors.numberOfSockets:2
Example
Show assets with this processor speed
processors.speed:2394
Example
Show number of threads per core
processors.threadsPerCore:1
Examples
Show assets synced from Amazon AWS
provider: "AWS"
Examples
Show sensors activated for VM
sensors.activatedForModules: "VM"
Show sensors activated for VM and FIM
sensors.activatednForModules: "VM"
AND sensors.activatedForModules: "FIM"
Example
Show agents with error status
agent.errorStatus: "true"
Examples
Show last compliance scan within certain dates
sensors.lastComplianceScan:[2019-01-01 ... 2019-01-15]
Show last compliance scan starting 2019-01-15, ending 1 month ago
sensors.lastComplianceScan:[2019-01-15 ... now-1M]
Show last compliance scan starting 2 weeks ago, ending 1 second ago
sensors.lastComplianceScan:[now-2w ... now-1s]
Show last compliance scan on a specific date
sensors.lastComplianceScan:'2019-03-18'
Examples
Show last full scan within certain dates
sensors.lastFullScan:[2019-01-01 ... 2019-01-15]
Show last full scan starting 2019-01-15, ending 1 month ago
sensors.lastFullScan:[2019-01-15 ... now-1M]
Show last full scan starting 2 weeks ago, ending 1 second ago
sensors.lastFullScan:[now-2w ... now-1s]
Show last full scan on a specific date
sensors.lastFullScan:'2019-03-18'
Examples
Show last VM scan within certain dates
sensors.lastVmScan:[2019-01-01 ... 2019-01-15]
Show last VM scan starting 2019-01-15, ending 1 month ago
sensors.lastVmScan:[2019-01-15 ... now-1M]
Show last VM scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScan:[now-2w ... now-1s]
Show last VM scan on a specific date
sensors.lastVmScan:'2019-03-18'
Examples
Show last VM scan within certain dates
sensors.lastVmScanDateScanner:[2019-01-01 ...
2019-01-15]
Show last VM scan starting 2019-01-15, ending 1 month ago
sensors.lastVmScanDateScanner:[2019-01-15 ...
now-1M]
Show last VM scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScanDateScanner:[now-2w ... now-1s]
Show last VM scan on a specific date
sensors.lastVmScanDateScanner:'2019-03-18'
Examples
Show last VM scan within certain dates
sensors.lastVmScanDateAgent:[2019-01-01 ... 2019-01-15]
Show last VM scan starting 2019-01-15, ending 1 month ago
sensors.lastVmScanDateAgent:[2019-01-15 ... now-1M]
Show last VM scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScanDateAgent:[now-2w ... now-1s]
Show last VM scan on a specific date
sensors.lastVmScanDateAgent:'2019-03-18'
Examples
Show last PC scan within certain dates
sensors.lastPcScanDateScanner:[2019-01-01 ...
2019-01-15]
Show last PC scan starting 2019-01-15, ending 1 month ago
sensors.lastPcScanDateScanner:[2019-01-15 ...
now-1M]
Show last PC scan starting 2 weeks ago, ending 1 second ago
sensors.lastPcScanDateScanner:[now-2w ... now-1s]
Show last PC scan on a specific date
sensors.lastPcScanDateScanner:'2019-03-18'
Examples
Show last PC scan within certain dates
sensors.lastPcScanDateAgent:[2019-01-01 ... 2019-01-15]
Show last PC scan starting 2019-01-15, ending 1 month ago
sensors.lastPcScanDateAgent:[2019-01-15 ... now-1M]
Show last PC scan starting 2 weeks ago, ending 1 second ago
sensors.lastPcScanDateAgent:[now-2w ... now-1s]
Show last PC scan on a specific date
sensors.lastPcScanDateAgent:'2019-03-18'
sensors.pendingActivationForModules
Examples
Show sensors pending activation for VM
sensors.pendingActivationForModules: "VM"
Show sensors pending activation for VM and FIM
sensors.pendingActivationForModules: "VM"
AND sensors.pendingActivationForModules: "FIM"
Examples
Show any findings that contain parts of description
services:(description:"Certificate Propagation")
Show any findings that match exact value "Windows Event Log"
services:(description:`Certificate Propagation`)
Example
Show any findings that match exact value
services:(name:CertPropSvc)
Example
Show any findings that match exact value
services:(status:RUNNING)
Examples
Show any findings that contain parts of name
software:"Microsoft Office 2016 (16.0.1.2)
Professional"
Show any findings that match exact value
software:`Microsoft Office 2016 (16.0.1.2) Professional`
Example
Show any findings that match exact value
software:(architecture:64-Bit)
Example
Show any findings that match exact value
software:(category:`Application
Development/Testing`)
Example
Show software that is required
software:(isRequired: "true")
Example
Show asset that has a missing software
asset.hasMissingSoftware: "true"
Example
If you are searching for assets missing testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
missingSoftware.category1:Application Development
Example
If you are searching for assets missing testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
missingSoftware.category2:Testing
Example
Show findings without this software publisher
missingSoftware.publisher:Microsoft
Example
Show findings with this exact product name
missingSoftware.product:Office
Examples
Show any findings with this name
missingSoftware.name: VMware Tools
Show any findings that contain parts of name
missingSoftware.name: "VMware Tools"
Show any findings that match exact value
missingSoftware.name: `VMware Tools`
Find assets with certain tag and missing software
tags.name: `Cloud Agent` AND missingSoftware.name:
`Cisco AnyConnect Secure Mobility Client` AND
version: `3.1.12345`
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category1:Application Development)
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category2:Testing)
Example
Show any findings that match exact value
software:(edition:Professional)
Examples
Show software installed within certain dates
software:(installDate:[2019-01-01 ... 2019-01-15])
Show software installed starting 2019-01-15, ending 1 month ago
software:(installDate:[2019-01-15 ... now-1M])
Show software installed starting 2 weeks ago, ending 1 second ago
software:(installDate:[now-2w ... now-1s])
Show software installed on a specific date
software:(installDate:'2019-03-18')
Example
Show findings with this exact software install path
software:(installPath:C:\Program Files\)
Example
Show software that is a package
software:(isPackage: "true")
Example
Show software that is PC supported
software:(isPCSupported: "true")
Example
Show software that has a running instance
software:(hasRunningInstance: "true")
Example
Show software that is a package component
software:(isPackageComponent: "true")
Examples
Show software last updated within certain dates
software:(lastUpdated:[2019-01-01 ... 2019-01-15])
Show software last updated starting 2019-01-15, ending 1 month ago
software:(lastUpdated:[2019-01-15 ... now-1M])
Show software last updated starting 2 weeks ago, ending 1 second ago
software:(lastUpdated:[now-2w ... now-1s])
Show software last updated on a specific date
software:(lastUpdated:'2019-03-18')
Note: This token is not supported for windows assets.
Examples
Show software last used within certain dates
software:(lastUseDate:[2019-01-01 ... 2019-01-15])
Show software last used starting 2019-01-15, ending 1 month ago
software:(lastUseDate:[2019-01-15 ... now-1M])
Show software last used starting 2 weeks ago, ending 1 second ago
software:(lastUseDate:[now-2w ... now-1s])
Show software last used on a specific date
software:(lastUseDate:'2019-03-18')
Example
Show any findings that match exact value
software:(license.category:`Open Source`)
Example
Show any findings that match exact value
software:(license.subcategory:Apache 2.0)
Examples
Show findings with software GA date in this date range
software:(lifecycle.ga:[2019-01-01 ... 2019-01-15])
Show findings with woftware GA date starting 2019-01-15, ending 1 month ago
software:(lifecycle.ga:[2019-01-15 ... now-1M])
Show findings with software GA date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.ga:[now-2w ... now-1s])
Show findings with this software GA date
software:(lifecycle.ga:'2019-03-18')
Examples
Show findings with software End-of-Life date in this date range
software:(lifecycle.eol:[2019-01-01 ... 2019-01-15])
Show findings with software End-of-Life date starting 2019-01-15, ending 1 month ago
software:(lifecycle.eol:[2019-01-15 ... now-1M])
Show findings with software End-of-Life date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.eol:[now-2w ... now-1s])
Show findings with this software End-of-Life date
software:(lifecycle.eol:'2019-03-18')
Examples
Show findings with software End-of-Support date in this date range
software:(lifecycle.eos:[2019-01-01 ... 2019-01-15])
Show findings with software End-of-Support date starting 2019-01-15, ending 1 month ago
software:(lifecycle.eos:[2019-01-15 ... now-1M])
Show findings with software End-of-Support date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.eos:[now-2w ... now-1s])
Show findings with this software End-of-Support date
software:(lifecycle.eos:'2019-03-18')
Examples
Show findings having this software lifecycle stage
software:(lifecycle.stage:eol)
Show findings having software category Windows and software lifecycle stage "active"
software:(category:Windows AND lifecycle.stage:eol)
Example
Show any findings that match exact value
software:(marketVersion:7)
Examples
Show any findings with this name
software:(name: VMware Tools)
Show any findings that contain parts of name
software:(name: "VMware Tools")
Show any findings that match exact value
software:(name: `VMware Tools`)
Find assets with certain tag and software installed
tags.name: `Cloud Agent` AND software:
(name: `Cisco AnyConnect Secure Mobility Client`
AND version: `3.1.12345`)
Example
Show findings with this exact product name
software:(product:Office)
Example
Show installations of the software that was marked as Authorized.
software:(authorization:`Authorized`)
Show installations of the software that was marked as Unauthorized.
software:(authorization:`Unauthorized`)
Show installations of the software that needs review.
software:(authorization:`Needs Review`)
Example
Show findings with this exact software publisher
software:(publisher:Microsoft)
Example
Show software having premium support
software:(supportStage: Premier Support)
Example
Show findings having this software type
software:(type:Installer Package)
Example
Show findings with this exact software update version
software:(update:16.0.1.2)
Show findings with software update version greater than 16.0.1.2
software:(update>16.0.1.2)
Show findings with software update version greater than or equal to 16.0.1.2
software:(update>=16.0.1.2)
Show findings with software update version less than 16.0.1.2
software:(update<16.0.1.2)
Show findings with software update version less than or equal to 16.0.1.2
software:(update<=16.0.1.2)
Show findings with software update version within this version range
software:(update:[16.0.1.2 ... 16.0.1.5])
Example
Show findings with this exact software version
software:(version:16.0)
Show findings with software version greater than 16.0
software:(version>16.0)
Show findings with software version greater than or equal to 16.0
software:(version>=16.0)
Show findings with software version less than 16.0
software:(version<16.0)
Show findings with software version less than or equal to 16.0
software:(version<=16.0)
Show findings with software version within this version range
software:(version:[16.0 ... 20.0])
Example
Show findings with Client software component
software:(component:Client)
Examples
Show assets with software first found within certain dates
software:(firstFound: [2017-06-15 ... 2017-06-30])
Show assets with software first found starting 2017-06-22, ending 1 month ago
software:(firstFound: [2017-06-22 ... now-1M])
Show assets with software first found starting 2 weeks ago, ending 1 second ago
software:(firstFound: [now-2w ... now-1s])
Show assets with software first found on specific date
software:(firstFound:'2017-06-14')
Example
Find assets with high business impact
tags.businessImpact: HIGH
Examples
Show any findings that contain "network" and "blue" in name
tags.name: "network blue"
Show any findings that contain "network" or "blue" in name (another method)
tags.name: "network" OR tags.name:
blue"
Show any findings that match exact value "Cloud Agent"
tags.name: `Cloud Agent`
Examples
Show findings with free volume space greater than 90 GB
volumes:(free>90)
Show findings with free volume space greater than or equal to 90 GB
volumes:(free>=90)
Show findings with free volume space less than 30 GB
volumes:(free<30)
Show findings with free volume space less than or equal to 30 GB
volumes:(free<=30)
Example
Show findings with this volume name
volumes:(name:D:)
Example
Show findings with volume size greater than 90 GB
volumes:(size>90)
Show findings with volume size greater than or equal to 90 GB
volumes:(size>=90)
Show findings with volume size less than 30 GB
volumes:(size<30)
Show findings with volume size less than or equal to 30 GB
volume:(size<=30)
Examples
Find VM instances with key "department"
gcp.labels:(name: department)
Find VM instances that match exact key value "department"
gcp.labels:(name: 'department')
Find VM instances with key starting "dep"
gcp.labels:(name: dep*)
Examples
Find VM instances with tag value "product-management"
gcp.labels:(value: product-management)
Find VM instances that match exact key value "product-management"
gcp.labels:(value: 'product-management')
Find VM instances with tag value starting "product"
gcp.labels:(value: product*)
Examples
Show assets details that match the exact value of the organization name
asset.org.name: `Qualys, Inc.`
Show assets details that contain parts of the organization name
asset.org.name: "Qualys,"
Examples
Show assets that match the exact ISP name
asset.isp: `amazon.com, Inc.`
Show assets that are with the parts of the ISP name
asset.isp: "amazon.com,"
Examples
Show assets that match the exact value of ASN
asset.asn: `AS8075`
Show assets that are with the parts of the ASN
asset.asn: "AS807"
Examples
Show assets that match the exact value of the domain
asset.domain: `qualys.com`
Show assets that contain parts of the domain
asset.domain: "qualys."
Examples
Show assets that match the exact value of the subdomains
asset.subdomain: `doc.qualys.com`
Show assets that contain the parts of the subdomains
asset.subdomain: "doc.qualys."
Examples
Show assets with whoIs creation date within certain dates
whoIs:(creationDate: [2019-01-01 ... 2019-01-15])
Show assets with whoIs creation date starting 2019-01-15, ending 1 month ago
whoIs:(creationDate: [2019-01-15 ... now-1M])
Show assets with whoIs creation date starting 2 weeks ago, ending 1-second ago
whoIs:(creationDate: [now-2w ... now-1s])
Show assets with whoIs creation date last updated on a specific date
whoIs:(creationDate: `2022-06-04`)
Examples
Show all the assets for which the exact registrant organization of domain/subdomain matches
whoIs:(registrantOrg: `Qualys, Inc`)
Show all the assets for which the part of the registrant organization of domain/subdomain matches
whoIs:(registrantOrg: "Qualys,")
Examples
Show all the assets for which the exact registrant email id of the domain or subdomain matches
whoIs:(registrantEmailId: `66aab8e6ace-49101@contact.qualys.net`)
Show all the assets for which the part of the registrant email
id of the domain or subdomain matches
whoIs:(registrantEmailId: "66aab8e6ace-49101@contact.qualys.net")
Examples
Show all the assets for which the exact registrar matches
whoIs:(registrar: `abc net`)
Show all assets for which the part of the registrar matches
whoIs:(registrar: "abc net")
Example
Show assets with active agents
agent.status: ACTIVE
Example
Show assets on windows platform
agent.platform: Windows
Use these tokens when searching your AWS EC2 assets on the Assets list.
- Your results may return Terminated instances. It's recommended you include aws.ec2instanceState in your query to reduce the number of results.
- The syntax is different when writing queries for tag rules than when searching assets in the Assets list. Be sure to follow the syntax tips in the drop-down when writing your query.
Examples
Find EC2 instances that match this account ID
aws.ec2.accountId: 123456789012
Find EC2 instances with account ID starting "12345"
aws.ec2.accountId: 12345*
Find EC2 instances where account ID is null (remove the colon)
aws.ec2.accountId is null
Example
Find EC2 instances in the us-east-1a availability zone
aws.ec2.availabilityZone: us-east-1a
Examples
Show findings with a cloud agent
aws.ec2.hasAgent: true
Show findings without a cloud agent
aws.ec2.hasAgent: false
Examples
Find instances related to name
aws.ec2.hostname: abc.qualys.com
Find instances that match exact value
aws.ec2.hostname: `abc.qualys.com`
Examples
Find instances related to the Image ID
aws.ec2.imageId: ami-2ea83347
Find instances that match exact value
aws.ec2.imageId: `ami-2ea83347`
Example
Find EC2 instances with this ID
aws.ec2.instanceId: i-1234567890abcdef0
Example
Find running EC2 instances
aws.ec2.instanceState: RUNNING
Example
Find EC2 instances with instance type t2.micro
aws.ec2.instanceType: t2.micro
Examples
Show findings where assets are scanners
aws.ec2.isQualysScanner: true
Show findings where assets are not scanners
aws.ec2.isQualysScanner: false
Example
Find EC2 instances with this kernel ID
aws.ec2.kernelId: aki-70ab0c10
Examples
Find EC2 instances launched within certain dates
aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]
Find EC2 instances launched on specific date
aws.ec2.launchDate:'2017-08-15'
Example
Find the EC2 instance with this private DNS address
aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal
Examples
Find EC2 instances with this private IP address
aws.ec2.privateIpAddress: 10.90.0.119
Find EC2 instances within this IP range
aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]
Example
Find the EC2 instance with this public DNS address
aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com
Examples
Find EC2 instances with this public IP address
aws.ec2.publicIpAddress: 52.70.141.154
Find EC2 instances within this IP range
aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]
Example
Find EC2 instances in the us-east-1 region
aws.ec2.region.code: us-east-1
Example
Find EC2 instances in the US East (N. Virginia) region
aws.ec2.region.name: US East (N. Virginia)
Examples
Show EC2 Spot instances
aws.ec2.spotInstance: "true"
Show EC2 instances that are not Spot instances
aws.ec2.spotInstance: "false"
Example
Find EC2 instances with this subnet ID
aws.ec2.subnetId: subnet-bc02c0d4
Example
Find EC2 instances with this VPC ID
aws.ec2.vpcId: vpc-1e37cd76
Examples
Find EC2 instances with key "devops"
aws.tags(key: devops)
Find EC2 instances with key starting "dev"
aws.tags(key: dev*)
Find EC2 instances with key ending "ops"
aws.tags(key: *ops)
Examples
Find EC2 instances with tag value "dailybuild"
aws.tags(value: dailybuild)
Find EC2 instances with tag value starting "daily"
aws.tags(value: daily*)
Find EC2 instances with tag value ending "build"
aws.tags(value: *build)
Use these tokens when searching Microsoft Azure assets on the Assets list.
Examples
Find Azure instances with name "devops"
azure.tags(name: devops)
Find Azure instances with name starting "dev"
azure:tags(name: dev*)
Find Azure instances with name ending "ops"
azure.tags(name: *ops)
Examples
Find Azure instances with tag value "dailybuild"
azure.tags(value: dailybuild)
Find Azure instances with tag value starting "daily"
azure.tags(value: daily*)
Find Azure instances with tag value ending "build"
azure.tags(value: *build)
Examples
Find Azure instances related to name
azure.vm.imageOffer: UbuntuServer
Find Azure instances that match exact value
azure.vm.imageOffer: `UbuntuServer`
Examples
Find Azure instances related to name
azure.vm.imagePublisher: Canonical
Find Azure instances that match exact value
azure.vm.imagePublisher: `Canonical`
Example
Find Azure instances with this sku version
azure.vm.imageVersion: 16.04.201708030
Example
Find Azure instances in this location
azure.vm.location: westus
Example
Find Azure instances with this MAC address
azure.vm.macAddress: '000D3A36DDED'
Examples
Find Azure instances related to name
azure.vm.name: avset2
Find Azure instances that match exact value
azure.vm.name: `avset2`
Example
Find Azure instances on Windows platform
azure.vm.platform: Windows
Examples
Find Azure instances with this private IP
azure.vm.privateIpAddress: 10.1.2.5
Find Azure instances within this IP range
azure.vm.privateIpAddress: [10.1.2.5 ... 10.1.2.33]
Examples
Find Azure instances with this public IP
azure.vm.publicIpAddress: 13.126.125.189
Find Azure instances within this IP range
azure.vm.publicIpAddress: [13.126.125.180 ...
13.126.125.255]
Examples
Find Azure instances related to virtual network
azure.vm.virtualNetwork: cli-vnet
Find Azure instances that match exact value of virtual network
azure.vm.virtualNetwork: `cli-vnet`
Examples
Find Azure instances related to name
azure.vm.resourceGroupName: my-eastus-rg
Find Azure instances that match exact value
azure.vm.resourceGroupName: `my-eastus-rg`
Example
Find Azure instances with this size
azure.vm.size: Standard_D1
Example
Find running Azure instances
azure.vm.state: RUNNING
Example
Find Azure instances with this subnet
azure.vm.subnet: 10.1.2.0
Example
Find Azure instances with this subscription ID
azure.vm.subscriptionId: fbb9ea64-abda-452e-adfa-83442409
Example
Find Azure instances with this ID
azure.vm.vmId: 13f56399-bd52-4150-9748-7190aae1ff21
Example
Find Azure instances with agents
azure.vm.hasAgent: "true"
Use these tokens when searching Google Cloud Platform assets on the Assets list.
Example
Find GCP instances with a tag key "abc" and value "xyz"
gcp.tags: (key:abc and value:xyz)
Examples
Find GCP instances related to name
gcp.compute.hostname: instance-5.c.qvsa-dev.internal
Find GCP instances that match exact value
gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`
Examples
Find GCP instances related to the Image ID
gcp.compute.imageId: projects/centos-cloud
Find GCP instances that match exact value
gcp.compute.imageId: `projects/centos-cloud/global/images/centos-6-v20191014`
Example
Find GCP instances with this ID
gcp.compute.instanceId: 4392196237934605253
Example
Find GCP instances with this MAC address
gcp.compute.macAddress: '000D3A36DDED'
Examples
Find GCP instances related to name
gcp.compute.machineType: n1-standard-1
Find GCP instances that match exact value
gcp.compute.machineType: `n1-standard-1`
Example
Find GCP instances with this network
gcp.compute.network: 000D3A36DDED
Examples
Find GCP instances with this private IP
gcp.compute.privateIpAddress: 10.240.0.7
Find GCP instances with this private IP range
gcp.compute.privateIpAddress: [10.240.0.7 ...
10.240.0.30]
Examples
Find GCP instances related to ID
gcp.compute.projectId: qvsa-dev
Find GCP instances that match exact value
gcp.compute.projectId: `qvsa-dev`
Examples
Find GCP instances related to this number
gcp.compute.projectNumber: 1035365309337
Find GCP instances that match exact value
gcp.compute.projectNumber: `1035365309337`
Examples
Find GCP instances with this public IP
gcp.compute.publicIpAddress: 104.196.57.216
Find GCP instances within this IP range
gcp.compute.publicIpAddress: [104.196.57.216 ...
104.196.57.218]
Type your drop-dowSelect the name of the instance state (PENDING, RUNNING, STOPPED, TERMINATED, STOPPING, SHUTTING_DOWN, DEALLOCATED) you're interested in. Select from names in the drop-down menu.
Example
Find running GCP instances
gcp.compute.state: RUNNING
Examples
Find GCP instances related to name
gcp.compute.zone: us-east1-d
Find GCP instances that match exact value
gcp.compute.zone: `us-east1-d`
Example
Find GCP instances with agents
gcp.compute.hasAgent: "true"
Use these tokens when searching Oracle Cloud Infrastructure (OCI) assets on the Assets list.
oci.compute.availabilityDomain
Example
Show all assets with the available domain Lhkx:US-ASHBURN-AD-1
oci.compute.availabilityDomain:"Lhkx:US-ASHBURN-AD-1"
oci.compute.canonicalRegionName
Example
Show all assets with the canonical region name us-ashburn-1
oci.compute.canonicalRegionName:"us-ashburn-1"
Example
Show assets with this OCI compartment ID
oci.compute.compartmentId:"ocid1.compartment.oc1..123452sjze35z6bkhvwjtzzgcp534zj4o75tgsizg3q36wl447jvfg6dq"
Example
Show assets with this OCI compartment name
oci.compute.compartmentName:"ocid1.compartment.abc"
Example
Show assets with display name oracle 8.
oci.compute.displayName:"oracle 8"
Example
Show all assets with fault domain FAULT-DOMAIN-1
oci.compute.faultDomain:"FAULT-DOMAIN-1"
Example
Show all assets with having cloud agent installed
oci.compute.hasAgent:"true"
Example
Show all findings with the host name oracle-8
oci.compute.hostName:"oracle-8"
Example
Show all assets with the ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq image ID
oci.compute.imageId:"ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq"
Example
Show all assets that are Qualys Scanner.
oci.compute.isQualysScanner:"true"
Example
Show assets with this OCI ID
oci.compute.ociId:"ocid1.compartment.oc1..1234567lbhcx2ajiagh57wrurvqs2ubd4ttaimgy22cxh3r6brpmmugq"
Example
Show all assets with the region us-east-1
oci.compute.region:"us-east-1"
Example
Show all assets with the region key SYD
oci.compute.regionKey:"SYD"
Example
Show all assets with the region realm OC1
oci.compute.regionRealm:"OC1"
Example
Show all assets with the shape x5-2.36.512
oci.compute.shape:"x5-2.36.512"
Example
Show all assets with the compute state Starting
oci.compute.state:STARTING
Example
Show all assets with the specific tenant ID
oci.compute.tenantId:"ocid1.tenancy.oc1..aaaaaaaax2gwhq3hszjqhte5pgzijgyge6gvlsrqar6kxn7itwhk7keokamq"
Example
Show all assets with the specific tenant name
oci.compute.tenantName:"oraclecengg1"
Example
Show findings with last check in within a specific date range.
oci.compute.timeCreated:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
oci.compute.timeCreated:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago.
Example
Show all assets with the tag key CreatedBy
oci.tags(key:CreatedBy)
Example
Show all assets with the namespace Oracle-Tags
oci.tags(namespace:"Oracle-Tags")
Example
Show all assets with the specific tag type
oci.tags(type:DEFINED)
Example
Show all assets with the tag value 2021-02-09
oci.tags(value:"2021-02-09")
Example
Show all assets with the MAC address 02:00:17:06:bd:b3
oci.vnic(macAddr:"02:00:17:06:bd:b3")
Example
Show all assets with the index 1
oci.vnic(nicIndex:1)
Example
Show all assets with this private IP
oci.vnic(privateIp:10.0.0.222)
Example
Show all assets with this public IP
oci.vnic(publicIp:10.0.0.222)
Example
Show all assets with the block 10.0.0.0/24
oci.vnic(subnetCidrBlock:10.0.0.0/24)
Example
Find OCI instances with this subnet ID
oci.vnic(subnetId: "subnet-bc02c0d4")
Example
Find OCI instances with this subnet name
oci.vnic(subnetName: "subnet-abc")
Example
Show all assets with this VCN ID
oci.vnic(vcnId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
Example
Show all assets with this vcn name
oci.vnic(vcnName:"abc")
Example
Show all assets with the router IP 10.0.0.1
oci.vnic(virtualRouterIp:10.0.0.1)
Example
Show all assets with the vlan tag 1
oci.vnic(vlanTag:1)
Example
Show all assets with the VNIC ID ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q
oci.vnic(vnicId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
Use these tokens when searching IBM Cloud assets on the Assets list.
Examples
Find IBM instances with name "devops"
ibm.tags(name: devops)
Find IBM instances with name starting "dev"
ibm:tags(name: dev*)
Find IBM instances with name ending "ops"
ibm.tags(name: *ops)
Examples
Find IBM instances with tag value "dailybuild"
ibm.tags(value: dailybuild)
Find IBM instances with tag value starting "daily"
ibm.tags(value: daily*)
Find IBM instances with tag value ending "build"
ibm.tags(value: *build)
ibm.virtualServer.datacenterId
Example
Find IBM instances with this datacenter ID
ibm.virtualServer.datacenterId: 1854895
Examples
Find IBM instances related to name
ibm.virtualServer.deviceName: "virtualserver01.Qualys-Inc.cloud"
Find IBM instances that match exact value
ibm.virtualServer.deviceName: `virtualserver01.Qualys-Inc.cloud`
Example
Show all assets with virtual server domain Qualys-Inc.cloud
ibm.virtualServer.domain:"Qualys-Inc.cloud"
Example
Show all assets with the 8998892 virtual server ID
ibm.virtualServer.id:8998892
Example
Find IBM instances in this location
ibm.virtualServer.location: "westus"
ibm.virtualServer.privateIpAddress
Examples
Find IBM instances with this private IP
ibm.virtualServer.privateIpAddress: 10.240.0.7
Find IBM instances with this private IP range
ibm.virtualServer.privateIpAddress: [10.240.0.7
... 10.240.0.30]
Example
Find the IBM instance with this private Vlan address
ibm.virtualServer.privateVlan: 3455
ibm.virtualServer.publicIpAddress
Examples
Find IBM instances with this public IP
ibm.virtualServer.publicIpAddress: 10.240.0.7
Find IBM instances with this public IP range
ibm.virtualServer.publicIpAddress: [10.240.0.7
... 10.240.0.30]
Example
Find the IBM instance with this public Vlan address
ibm.virtualServer.publicVlan: 3455
Example
Show all assets with the virtual server state Starting
ibm.virtualServer.state:STARTING
The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.
Narrow down your search by using the 'and' operator in your Boolean query. The result contains all the token values that you provide in your query.
Example
asset.status: Enrolled and asset.assetID: 122855563
The asset having the ID 122855563 and with status as Enrolled is returned in the result.
Narrow down your search by using the 'not' operator in your Boolean query. The result contains all the other values except the one that you specify after 'not' in your query.
Example
not tags.name: Windows
Assets with the Windows tag are excluded from search results.
Broaden your search by using the 'or' operator in your Boolean query. The result contains any of the token values that you provide in your query.
Example
tags.name:Cloud Agent or tags.name:Windows
The assets that have the Cloud Agent tag or the Windows tag are returned in the result.
Example
Show the asset with this FQDN
asset.fqdn:ACMENVT7.acme.com
Example
Show this hardware typing confidence
hardware.typingConfidence:HIGH
Example
Show this sensor ID
passiveSensor.id:"003687557369:1654660042:3809075:704:1654660042:3809075:704"
Examples
Show assets with sensor location (appliance location label) as SanJose1
passiveSensor.location:"SanJose1"
Examples
Show assets with sensor name as ITCorp-appliance
passiveSensor.name:"ITCorp-appliance"
Examples
Show open ports found within certain dates
openPorts.lastFound: [2019-01-01 ... 2019-01-15]
Show open ports found starting 2019-01-15, ending 3 months ago
openPorts.lastFound: [2019-01-15 ... now-3M]
Show open ports found starting 2 weeks ago, ending 1 second ago
openPorts.lastFound: [now-2w ... now-1s]
Show open ports found on a specific date
openPorts.lastFound:'2019-03-18'
Examples
Show ports updated within certain dates
openPort.lastUpdated: [2019-01-01 ... 2019-01-15]
Show ports updated starting 2019-01-15, ending 3 months ago
openPort.lastUpdated: [2019-01-15 ... now-3M]
Show ports updated starting 2 weeks ago, ending 1 second ago
openPort.lastUpdated: [now-2w ... now-1s]
Show ports updated on a specific date
openPort.lastUpdated:'2019-03-18'
operatingSystem.typingConfidence
Example
Show this OS typing confidence
operatingSystem.typingConfidence:MEDIUM
Examples
Show assets with traffic timestamp 2019-03-18
traffic.timestamp:'2019-03-18'
Show assets with traffic timestamp within certain dates
traffic.timestamp:[2019-01-01 ... 2019-01-15]
Show assets with traffic timestamp starting 2019-01-15, ending 1 month ago
traffic.timestamp:[2019-01-15 ... now-1M]
Show assets with traffic timestamp starting 2 weeks ago, ending 1 second ago
traffic.timestamp:[now-2w ... now-1s]
Example
Show assets with 100 MB total traffic
traffic.total:100
Example
Show assets with 60 MB ingress traffic
traffic.ingress:60
Example
Show assets with 40 MB egress traffic
traffic.egress:40
Example
Show assets with traffic over TCP
traffic.protocol:tcp
Example
Show assets with traffic over port 80
traffic.port:80
Example
Show assets with client traffic
traffic.type:client
Example
Show assets with peer to peer traffic
traffic.family:Peer to Peer
Example
Show assets with traffic from BitTorrent
traffic.application:BitTorrent
Example
Show assets with traffic from HTTP
traffic.service:http
Example
Show traffic with this scanner ID
inventory.scannerID:345678892
Examples
Show any traffic that contain parts of name
inventory.scannerName:"acme-ps-001"
Show any traffic that match exact value "acme-ps-001"
inventory.scannerName:`acme-ps-001`
Example
Show traffic with scanner location as Pune 10th floor States
inventory.scannerLocation: Pune 10th floor
Example
Find traffic of client type Managed
client.type: Managed
Example
Show traffic with this client asset ID
client.assetID:122855563
Examples
Show any traffic that contain parts of name
client.name:"ACMENVT7"
Show any traffic that match exact value "ACMENVT7"
client.name:`ACMENVT7`
Examples
Show traffic with last logon by user jdoe
client.lastLoggedOnUser:jdoe
Examples
Show any traffic that contain "rouge" and "BYOD" in name
client.tags.name: "rouge, BYOD"
Show any traffic that contain "rouge" or "BYOD" in name (another method)
client.tags.name: "rouge" OR
client.tags.name: BYOD"
Show any traffic that match exact value "rouge, BYOD"
client.tags.name: `rouge, BYOD`
Examples
Show any traffic that match exact value
client.hardware.category:Computer/Server
Examples
Show any traffic that contain parts of name
client.hardware:"Dell Latitude e7470"
Show any traffic that match exact value
client.hardware:`Dell Latitude e7470`
client.operatingSystem.category
Example
Show any traffic that match exact value
client.operatingSystem.category:Windows/Client
Examples
Show any traffic that contain components of OS name
client.operatingSystem:"Windows 7 Enterprise
(6.1 SP2) 64Bit"
Show any traffic that match exact value
client.operatingSystem:`Windows 7 Enterprise (6.1
SP2) 64Bit`
Example
Show the traffic with this MAC address
client.interfaces.macAddress:"00:0D:3A:27:15:BA"
Examples
Show traffic for this IP address
client.interfaces.address:10.20.0.5
Example
Find traffic for server type Internal
server.type: Internal
Example
Show traffic for this asset ID
server.assetID:122855563
Examples
Show any traffic that contain parts of name
server.name:"ACMENVT7"
Show any traffic that match exact value "ACMENVT7"
server.name:`ACMENVT7`
Examples
Show traffic with last logon by user jdoe
server.lastLoggedOnUser:jdoe
Use values within quotes or backticks to help you find the traffic based on tag name.
Examples
Show any traffic that contain "rouge" and "BYOD" in name
server.tags.name: "rouge, BYOD"
Show any traffic that contain "rouge" or "BYOD" in name (another method)
server.tags.name: "rouge" OR
server.tags.name: BYOD"
Show any traffic that match exact value "rouge, BYOD"
server.tags.name: `rouge, BYOD`
Use values within quotes or backticks to help you find the traffic based on server hardware category.
Examples
Show any traffic that match exact value
server.hardware.category:Computer/Server
Examples
Show any traffic that contain parts of name
server.hardware:"Dell Latitude e7470"
Show any traffic that match exact value
server.hardware:`Dell Latitude e7470`
server.operatingSystem.category
Example
Show any traffic that match exact value
server.operatingSystem.category:Windows/Client
Examples
Show any traffic that contain components of OS name
server.operatingSystem:"Windows 7 Enterprise
(6.1 SP2) 64Bit"
Show any traffic that match exact value
server.operatingSystem:`Windows 7 Enterprise (6.1
SP2) 64Bit`
Example
Show the traffic with this MAC address
server.interfaces.macAddress:"00:0D:3A:27:15:BA"
Examples
Show traffic for this IP address
server.interfaces.address:10.20.0.5
Example
Show traffic with server port 80
traffic.serverPort:80
Examples
Show Server-to-Client traffic greater than 60B volume
traffic.stc.volume > 60
Show Server-to-Client traffic
less than 100B volume
traffic.stc.volume < 100
Examples
Show Client-to-Server traffic greater than 80B volume
traffic.cts.volume > 80
Show Client-to-Server traffic less than 20B volume
traffic.cts.volume < 20
Examples
Show total traffic greater than 100B volume
traffic.total.volume > 100
Show total traffic less than 30B volume
traffic.total.volume < 30
Example
Show traffic with reporting start time
traffic.reportingStartTime > '2020-07-01'
Example
Show traffic with reporting end time
traffic.reportingEndTime < '2020-07-01'