Use these tokens in the tag creation wizard (Dynamic tag > Asset Inventory rule).
Example
Show findings with username administrator
accounts.username:administrator
Examples
Show any findings that contain parts of description
asset.biosDescription:"American Megatrends
Inc."
Show any findings that match exact value "American Megatrends Inc."
asset.biosDescription:`American Megatrends Inc.`
Examples
Show assets created within certain dates
asset.created:[2019-01-01 ... 2019-01-15]
Show assets created starting 2019-01-15, ending 1 month ago
asset.created:[2019-01-15
... now-1M]
Show assets created starting 2 weeks ago, ending 1 second ago
asset.created:[now-2w ... now-1s]
Show assets created on a specific date
asset.created:'2019-03-18'
Examples
Show any findings that match the beginning of any substrings within the asset name
asset.name:"ACMENVT7"
Show any findings that match exact value "ACMENVT7"
asset.name:`ACMENVT7`
Example
Show assets with operational status as Repair
asset.operationalStatus: Repair
Example
Show assets with environment as Development
asset.environment: Development
Example
Show assets with last location as Redwood City, California - United States
asset.lastLocation: 'Redwood City, California
- United States'
Example
Show assets with last location with exact string
asset.lastLocation: `Redwood City, California
- United States`
Example
Show assets with last location continent as North America
asset.lastLocation.continent: North America
Example
Show assets with last location country as United States
asset.lastLocation.country: United States
Example
Show assets with last location city as Redwood City
asset.lastLocation.city: Redwood City
Example
Show assets with last location postal as 94065
asset.lastLocation.postal: 94065
Examples
Show assets with last logon by user asmith
asset.lastLoggedOnUser:asmith
Example
Show assets with last location state as California
asset.lastLocation.state: California
Examples
Show assets last updated within certain dates
asset.lastUpdated:[2019-01-01 ... 2019-01-15]
Show assets last updated starting 2019-01-15, ending 1 month ago
asset.lastUpdated:[2019-01-15
... now-1M]
Show assets last updated starting 2 weeks ago, ending 1 second ago
asset.lastUpdated:[now-2w ... now-1s]
Show assets last updated on a specific date
asset.lastUpdated:'2019-03-18'
Examples
Show the asset with this name
asset.netbiosName:ACMENVT7
Example
Show assets with support group as Compliance Managers
asset.supportGroup: Compliance Managers
Example
Show assets with this timezone
asset.timezone:"-08:00"
Example
Find assets with this tracking method
asset.trackingMethod: QAGENT
Examples
Show all the assets with a risk score 900
asset.riskScore:900
Show all the assets with risk score between the range 800 to 1000
asset.riskScore:[800 ... 1000]
Show all the assets with a risk score greater than 500
asset.riskScore >500
Show all the assets with a risk score less than or equal to 800
asset.riskScore <=800
Example
Show Docker containers
container.product: Docker
Example
Show containers of this version
container.version:1.6
Example
Find assets with high business impact
tags.businessImpact: HIGH
Example
Show assets with company as ACME Italy
asset.org.company: ACME Italy
Example
Show assets with department as Customer Support
asset.org.department: Customer Support
Examples
Show any findings that contain parts of name
businessApp:(name:"HR Intranet")
Show any findings that match exact value "HR Intranet"
businessApp:(name:`HR Intranet`)
Example
Find GCP instances with a tag key "abc" and value "xyz"
gcp.tags: (key:abc and value:xyz)
Examples
Show any findings that contain parts of name
hardware:"Dell Latitude e7470"
Show any findings that match exact value
hardware:`Dell Latitude e7470`
Examples
Show any findings that match exact value
hardware.category:Printers/Laser
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category1:Printers
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category2:Laser
Example
Show any findings that match exact value "Dell"
hardware.manufacturer:`Dell`
Example
Show any findings that match exact value "e7470"
hardware.model:`De7470`
Example
Show any findings that match exact value "Latitude"
hardware.product:`Latitude`
Example
Show End-of-Sale hardware
hardware.lifecycle.stage:"EOS"
Examples
Show findings with hardware End-of-Sale date in this date range
hardware.lifecycle.eos:[2019-01-01 ... 2019-01-15]
Show findings with hardware End-of-Sale date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.eos:[2019-01-15 ... now-1M]
Show findings with hardware End-of-Sale date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.eos:[now-2w ... now-1s]
Show findings with this hardware End-of-Sale date
hardware.lifecycle.eos:'2019-03-18'
Examples
Show findings with hardware obsolete date in this date range
hardware.lifecycle.obs:[2019-01-01 ... 2019-01-15]
Show findings with hardware obsolete date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.obs:[2019-01-15 ... now-1M]
Show findings with hardware obsolete date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.obs:[now-2w ... now-1s]
Show findings with this hardware obsolete date
hardware.lifecycle.obs:'2019-03-18'
Examples
Show findings with hardware GA date in this date range
hardware.lifecycle.ga:[2019-01-01 ... 2019-01-15]
Show findings with hardware GA date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.ga:[2019-01-15 ... now-1M]
Show findings with hardware GA date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.ga:[now-2w ... now-1s]
Show findings with this hardware GA date
hardware.lifecycle.ga:'2019-03-18'
Examples
Show findings with hardware introduction date in this date range
hardware.lifecycle.intro:[2019-01-01 ... 2019-01-15]
Show findings with hardware introduction date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.intro:[2019-01-15 ... now-1M]
Show findings with hardware introduction date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.intro:[now-2w ... now-1s]
Show findings with this hardware introduction date
hardware.lifecycle.intro:'2019-03-18'
Examples
Show findings with hardware obsolete date in this date range
hardware.lifecycle.obs:[2019-01-01 ... 2019-01-15]
Show findings with hardware obsolete date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.obs:[2019-01-15 ... now-1M]
Show findings with hardware obsolete date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.obs:[now-2w ... now-1s]
Show findings with this hardware obsolete date
hardware.lifecycle.obs:'2019-03-18'
Examples
Show traffic for this IP address
client.interfaces.address:10.20.0.5
Example
Show the asset with name PRO/1000
interfaces:(interfaceName:PRO/1000)
Examples
Show the exact match of the IP address
interfaces:(address:`10.10.100.20`)
Show any findings that contain parts of the IP address
interfaces:(address:"10.10.100.2")
interfaces:(address: 10.10.100.2)
Example
Show assets with this default gateway address
interfaces:(gatewayAddress:10.11.65.1)
Example
Show software that is a package
software:(isPackage: "true")
Example
Show software that is a package component
software:(isPackageComponent: "true")
Examples
Show any findings with this service name
openPorts:(detectedService: win_remote_desktop)
Show any findings that contain parts of name
openPorts:(detectedService: "win_remote_desktop")
Show any findings that match exact value "win_remote_desktop"
openPorts:(detectedService: `win_remote_desktop`)
Example
Show assets with open port 80
openPorts:(port:80)
Examples
Show any findings that contain components of OS name
operatingSystem:"Windows 7 SP2 Enterprise"
Show any findings that match exact value
operatingSystem:`Windows 7 SP2 Enterprise`
Example
Show any findings that match exact value
operatingSystem.category:Windows/Embedded
Example
If you are searching for assets with Windows Embedded operating system, then category1 is Windows and category2 is Embedded.
Show any findings that match exact value
operatingSystem.category1:Windows
Example
If you are searching for assets with Windows Embedded operating system, then category1 is Windows and category2 is Embedded.
Show any findings that match exact value
operatingSystem.category2:Embedded
Example
Show findings with this exact software publisher
operatingSystem.publisher:Microsoft
Example
Show any findings that match exact value
operatingSystem.name:Windows 10
Example
Show any findings that match exact value
operatingSystem.architecture:64-Bit
Example
Show any findings that match exact value
operatingSystem.marketVersion:7
Example
Show findings with this exact OS version
operatingSystem.version:16.1
Example
Show findings with this exact OS update version
operatingSystem.update:SP2
Example
Show any findings that match exact value
operatingSystem.edition:Enterprise
operatingSystem.lifecycle.stage
Examples
Show findings having this OS lifecycle stage
operatingSystem.lifecycle.stage:eol
Show findings with OS category Windows and OS lifecycle stage "active"
operatingSystem:(category:Windows AND
lifecycle.stage:eol)
Examples
Show findings with OS GA date in this date range
operatingSystem.lifecycle.ga:[2019-01-01 ... 2019-01-15]
Show findings with OS GA date starting 2019-01-15, ending 1 month ago
operatingSystem.lifecycle.ga:[2019-01-15 ... now-1M]
Show findings with OS GA date starting 2 weeks ago, ending 1 second ago
operatingSystem.lifecycle.ga:[now-2w ... now-1s]
Show findings with this OS GA date
operatingSystem.lifecycle.ga:'2019-03-18'
Examples
Show findings with operating system End-of-Life date in this date range
operatingSystem.lifecycle.eol:[2019-01-01 ...
2019-01-15]
Show findings with operating system End-of-Life date starting 2019-01-15, ending 1 month ago
operatingSystem.lifecycle.eol:[2019-01-15 ...
now-1M]
Show findings with operating system End-of-Life date starting 2 weeks ago, ending 1 second ago
operatingSystem.lifecycle.eol:[now-2w ... now-1s]
Show findings with this operating system End-of-Life date
operatingSystem.lifecycle.eol:'2019-03-18'
Examples
Show findings with operating system End-of-Support date in this date range
operatingSystem.lifecycle.eos:[2019-01-01 ...
2019-01-15]
Show findings with operating system End-of-Support date starting 2019-01-15, ending 1 month ago
operatingSystem.lifecycle.eos:[2019-01-15 ...
now-1M]
Show findings with operating system End-of-Support date starting 2 weeks ago, ending 1 second ago
operatingSystem.lifecycle.eos:[now-2w ... now-1s]
Show findings with this operating system End-of-Support date
operatingSystem.lifecycle.eos:'2019-03-18'
Example
Show this sensor ID
passiveSensor.id:"003687557369:1654660042:3809075:704:1654660042:3809075:704"
Examples
Show assets with sensor location (appliance location label) as SanJose1
passiveSensor.location:"SanJose1"
Examples
Show assets with sensor name as ITCorp-appliance
passiveSensor.name:"ITCorp-appliance"
Examples
Show findings having this software lifecycle stage
software:(lifecycle.stage:eol)
Show findings having software category Windows and software lifecycle stage "active"
software:(category:Windows AND lifecycle.stage:eol)
Example
Show any findings that match exact value
services:(name:CertPropSvc)
Example
Show any findings that match exact value
services:(status:RUNNING)
Examples
Show sensors activated for VM
sensors.activatedForModules: "VM"
Show sensors activated for VM and PC
sensors.activatedForModules: "VM"
AND sensors.activatedForModules: "PC"
Examples
Show last full scan within certain dates
sensors.lastFullScan:[2019-01-01 ... 2019-01-15]
Show last full scan starting 2019-01-15, ending 1 month ago
sensors.lastFullScan:[2019-01-15 ... now-1M]
Show last full scan starting 2 weeks ago, ending 1 second ago
sensors.lastFullScan:[now-2w ... now-1s]
Show last full scan on a specific date
sensors.lastFullScan:'2019-03-18'
Example
Show any findings that match exact value
software:(license.category:`Open Source`)
Example
Show any findings that match exact value
software.architecture:64-Bit
Example
Show any findings that match exact value
software:(edition:Professional)
Example
Show any findings that match exact value
software.category:Application Development/Testing
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category1:Application Development)
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category2:Testing)
Example
Show any findings that match exact value
software:(marketVersion:7)
Example
Show findings with this exact product name
software:(product:Office)
Example
Show findings with this exact software publisher
software:(publisher:Microsoft)
Example
Show findings having this software type
software.type:Installer Package
Example
Show findings with this exact software update version
software:(update:16.0.1.2)
Show findings with software update version greater than 16.0.1.2
software:(update>16.0.1.2)
Show findings with software update version greater than or equal to 16.0.1.2
software:(update>=16.0.1.2)
Show findings with software update version less than 16.0.1.2
software:(update<16.0.1.2)
Show findings with software update version less than or equal to 16.0.1.2
software:(update<=16.0.1.2)
Show findings with software update version within this version range
software:(update:[16.0.1.2 ... 16.0.1.5])
Example
Show findings with this exact software version
software:(version:16.0)
Show findings with software version greater than 16.0
software:(version>16.0)
Show findings with software version greater than or equal to 16.0
software:(version>=16.0)
Show findings with software version less than 16.0
software:(version<16.0)
Show findings with software version less than or equal to 16.0
software:(version<=16.0)
Show findings with software version within this version range
software:(version:[16.0 ... 20.0])
Examples
Show findings with software GA date in this date range
software:(lifecycle.ga:[2019-01-01 ... 2019-01-15])
Show findings with woftware GA date starting 2019-01-15, ending 1 month ago
software:(lifecycle.ga:[2019-01-15 ... now-1M])
Show findings with software GA date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.ga:[now-2w ... now-1s])
Show findings with this software GA date
software:(lifecycle.ga:'2019-03-18')
Examples
Show findings with software End-of-Life date in this date range
software:(lifecycle.eol:[2019-01-01 ... 2019-01-15])
Show findings with software End-of-Life date starting 2019-01-15, ending 1 month ago
software:(lifecycle.eol:[2019-01-15 ... now-1M])
Show findings with software End-of-Life date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.eol:[now-2w ... now-1s])
Show findings with this software End-of-Life date
software:(lifecycle.eol:'2019-03-18')
Examples
Show findings with software End-of-Support date in this date range
software:(lifecycle.eos:[2019-01-01 ... 2019-01-15])
Show findings with software End-of-Support date starting 2019-01-15, ending 1 month ago
software:(lifecycle.eos:[2019-01-15 ... now-1M])
Show findings with software End-of-Support date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.eos:[now-2w ... now-1s])
Show findings with this software End-of-Support date
software:(lifecycle.eos:'2019-03-18')
Example
Show any findings that match exact value
software:(license.subcategory:Apache 2.0)
Examples
Show assets with software first found within certain dates
software:(firstFound: [2017-06-15 ... 2017-06-30])
Show assets with software first found starting 2017-06-22, ending 1 month ago
software:(firstFound: [2017-06-22 ... now-1M])
Show assets with software first found starting 2 weeks ago, ending 1 second ago
software:(firstFound: [now-2w ... now-1s])
Show assets with software first found on specific date
software:(firstFound:'2017-06-14')
Example
Show findings with Client software component
software:(component:Client)
Examples
Show assets synced from Amazon AWS
provider: "AWS"
Examples
Show any findings related to profile name
sensors.configurationProfile: Initial Profile
Show any findings that contain parts of the name
sensors.configurationProfile: "Initial Profile"
Show any findings that match exact value
sensors.configurationProfile: `Initial Profile`
Example
Show assets with agents activated using this key
sensors.agentActivations.key: 057cc48a-8d84-48eb-add4-97a605d0567d
Examples
Show findings with last activity within certain dates
sensors.lastActivity: [2016-01-01 ... 2016-01-10]
Show findings with last activity starting 2015-10-01, ending 1 month ago
sensors.lastActivity: [2015-10-01 ... now-1M]
Show findings with last activity starting 2 weeks ago, ending 1 second ago
sensors.lastActivity: [now-2w ... now-1s]
Show findings with last activity on a specific date
sensors.lastActivity:'2015-12-01'
Examples
Show findings with last check in within a specific date range.
sensors.lastCheckedIn:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
sensors.lastCheckedIn:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago
sensors.lastCheckedIn:[now-2w ... now-1s]
Show findings with last check in on a specific date
sensors.lastCheckedIn:'2020-02-11'
Show findings with last check in before (older than) last 30 days.
sensors.lastCheckedIn<now-30d
Note: We recommend not to use the NOT operator in your range search to form a query like NOT sensors.lastCheckedIn:[now-30d...now-2s]. See 'QQL Best Practices' topic in the Unified Dashboard online Help.
Show findings with last check in within last 30 days excluding day 30
sensors.lastCheckedIn>now-30d
Show findings with last check in within last 30 days including day 30
sensors.lastCheckedIn>=now-30d
Show findings with last check in which is older than last 30 days excluding day 30
sensors.lastCheckedIn<now-30d
Show findings with last check in which is older than last 30 days including day 30
sensors.lastCheckedIn<=now-30d
Examples
Show findings with last inventory scan within certain dates
sensors.lastInventory: [2018-06-01 ... 2018-06-10]
Show findings with last inventory scan on specific date
sensors.lastInventory:'2018-07-25'
Examples
Show last VM scan within certain dates
sensors.lastVmScan:[2019-01-01 ... 2019-01-15]
Show last VM scan starting 2019-01-15, ending 1 month ago
sensors.lastVmScan:[2019-01-15 ... now-1M]
Show last VM scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScan:[now-2w ... now-1s]
Show last VM scan on a specific date
sensors.lastVmScan:'2019-03-18'
Examples
Show findings with last vulnerability scan within certain dates
sensors.lastVmScanDate: [2017-01-01 ... 2017-02-10]
Show findings with last vulnerability scan starting 2016-11-01, ending 1 month ago
sensors.lastVmScanDate: [2016-11-01 ... now-1M]
Show findings with last vulnerability scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScanDate: [now-2w ... now-1s]
Show findings with last vulnerability scan on specific date
sensors.lastVmScanDate:'2017-04-10'
sensors.lastComplianceScanDate
Examples
Show findings with last compliance scan within certain dates
sensors.lastComplianceScanDate: [2017-01-01 ...
2017-03-31]
Show findings with last compliance scan starting 2016-10-15, ending 1 month ago
sensors.lastComplianceScanDate: [2016-10-15 ...
now-1M]
Show findings with last compliance scan starting 2 weeks ago, ending 1 second ago
sensors.lastComplianceScanDate: [now-2w ... now-1s]
Show findings with last compliance scan on specific date
sensors.lastComplianceScanDate:'2017-02-18'
Examples
Find EC2 instances that match this account ID
aws.ec2.accountId: 123456789012
Find EC2 instances with account ID starting "12345"
aws.ec2.accountId: 12345*
Find EC2 instances where account ID is null (remove the colon)
aws.ec2.accountId is null
Example
Find EC2 instances in the us-east-1a availability zone
aws.ec2.availabilityZone: us-east-1a
Examples
Show findings with a cloud agent
aws.ec2.hasAgent: true
Show findings without a cloud agent
aws.ec2.hasAgent: false
Examples
Find instances related to name
aws.ec2.hostname: abc.qualys.com
Find instances that match exact value
aws.ec2.hostname: `abc.qualys.com`
Examples
Find instances related to the Image ID
aws.ec2.imageId: ami-2ea83347
Find instances that match exact value
aws.ec2.imageId: `ami-2ea83347`
Example
Find EC2 instances with this ID
aws.ec2.instanceId: i-1234567890abcdef0
Example
Find running EC2 instances
aws.ec2.instanceState: RUNNING
Example
Find EC2 instances with instance type t2.micro
aws.ec2.instanceType: t2.micro
Examples
Show findings where assets are scanners
aws.ec2.isQualysScanner: true
Show findings where assets are not scanners
aws.ec2.isQualysScanner: false
Example
Find EC2 instances with this kernel ID
aws.ec2.kernelId: aki-70ab0c10
Examples
Find EC2 instances launched within certain dates
aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]
Find EC2 instances launched on specific date
aws.ec2.launchDate:'2017-08-15'
Example
Find the EC2 instance with this private DNS address
aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal
Examples
Find EC2 instances with this private IP address
aws.ec2.privateIpAddress: 10.90.0.119
Find EC2 instances within this IP range
aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]
Example
Find the EC2 instance with this public DNS address
aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com
Examples
Find EC2 instances with this public IP address
aws.ec2.publicIpAddress: 52.70.141.154
Find EC2 instances within this IP range
aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]
Example
Find EC2 instances in the us-east-1 region
aws.ec2.region.code: us-east-1
Example
Find EC2 instances in the US East (N. Virginia) region
aws.ec2.region.name: US East (N. Virginia)
Examples
Show EC2 Spot instances
aws.ec2.spotInstance: "true"
Show EC2 instances that are not Spot instances
aws.ec2.spotInstance: "false"
Example
Find EC2 instances with this subnet ID
aws.ec2.subnetId: subnet-bc02c0d4
Example
Find EC2 instances with this VPC ID
aws.ec2.vpcId: vpc-1e37cd76
Example
Find EC2 instances with an AWS tag with key "abc" and value "xyz"
aws.tags: (key:abc and value:xyz)
Examples
Find EC2 instances with key "devops"
aws.tags.key: devops
Find EC2 instances with key starting "dev"
aws.tags.key: dev*
Find EC2 instances with key ending "ops"
aws.tags.key: *ops
Examples
Find EC2 instances with tag value "dailybuild"
aws.tags.value: dailybuild
Find EC2 instances with tag value starting "daily"
aws.tags.value: daily*
Find EC2 instances with tag value ending "build"
aws.tags.value: *build
Example
Find Azure instances with a tag with name "abc" and value "xyz"
azure.tags: (name:abc and value:xyz)
Examples
Find Azure instances with name "devops"
azure.tags.name: devops
Find Azure instances with name starting "dev"
azure:(tags.name: dev*
Find Azure instances with name ending "ops"
azure.tags.name: *ops
Examples
Find Azure instances with tag value "dailybuild"
azure.tags.value: dailybuild
Find Azure instances with tag value starting "daily"
azure.tags.value: daily*
Find Azure instances with tag value ending "build"
azure.tags.value: *build
Examples
Find Azure instances related to name
azure.vm.imageOffer: UbuntuServer
Find Azure instances that match exact value
azure.vm.imageOffer: `UbuntuServer`
Examples
Find Azure instances related to name
azure.vm.imagePublisher: Canonical
Find Azure instances that match exact value
azure.vm.imagePublisher: `Canonical`
Example
Find Azure instances with this sku version
azure.vm.imageVersion: 16.04.201708030
Example
Find Azure instances in this location
azure.vm.location: westus
Example
Find Azure instances with this MAC address
azure.vm.macAddress: '000D3A36DDED'
Examples
Find Azure instances related to name
azure.vm.name: avset2
Find Azure instances that match exact value
azure.vm.name: `avset2`
Example
Find Azure instances on Windows platform
azure.vm.platform: Windows
Examples
Find Azure instances with this private IP
azure.vm.privateIpAddress: 10.1.2.5
Find Azure instances within this IP range
azure.vm.privateIpAddress: [10.1.2.5 ... 10.1.2.33]
Examples
Find Azure instances with this public IP
azure.vm.publicIpAddress: 13.126.125.189
Find Azure instances within this IP range
azure.vm.publicIpAddress: [13.126.125.180 ...
13.126.125.255]
Examples
Find Azure instances related to name
azure.vm.resourceGroupName: my-eastus-rg
Find Azure instances that match exact value
azure.vm.resourceGroupName: `my-eastus-rg`
Example
Find Azure instances with this size
azure.vm.size: Standard_D1
Example
Find running Azure instances
azure.vm.state: RUNNING
Example
Find Azure instances with this subnet
azure.vm.subnet: 10.1.2.0
Example
Find Azure instances with this subscription ID
azure.vm.subscriptionId: fbb9ea64-abda-452e-adfa-83442409
Examples
Find Azure instances related to virtual network
azure.vm.virtualNetwork: cli-vnet
Find Azure instances that match exact value of virtual network
azure.vm.virtualNetwork: `cli-vnet`
Example
Find Azure instances with this ID
azure.vm.vmId: 13f56399-bd52-4150-9748-7190aae1ff21
Example
Find Azure instances with agents
azure.vm.hasAgent: "true"
Examples
Find GCP instances related to name
gcp.compute.hostname: instance-5.c.qvsa-dev.internal
Find GCP instances that match exact value
gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`
Example
Find GCP instances with this ID
gcp.compute.instanceId: 4392196237934605253
Example
Find GCP instances with this MAC address
gcp.compute.macAddress: '000D3A36DDED'
Examples
Find GCP instances related to name
gcp.compute.machineType: n1-standard-1
Find GCP instances that match exact value
gcp.compute.machineType: `n1-standard-1`
Example
Find GCP instances with this network
gcp.compute.network: 000D3A36DDED
Examples
Find GCP instances with this private IP
gcp.compute.privateIpAddress: 10.240.0.7
Find GCP instances with this private IP range
gcp.compute.privateIpAddress: [10.240.0.7 ...
10.240.0.30]
Examples
Find GCP instances related to ID
gcp.compute.projectId: qvsa-dev
Find GCP instances that match exact value
gcp.compute.projectId: `qvsa-dev`
Examples
Find GCP instances related to this number
gcp.compute.projectNumber: 1035365309337
Find GCP instances that match exact value
gcp.compute.projectNumber: `1035365309337`
Examples
Find GCP instances with this public IP
gcp.compute.publicIpAddress: 104.196.57.216
Find GCP instances within this IP range
gcp.compute.publicIpAddress: [104.196.57.216 ...
104.196.57.218]
Type your drop-dowSelect the name of the instance state (PENDING, RUNNING, STOPPED, TERMINATED, STOPPING, SHUTTING_DOWN, DEALLOCATED) you're interested in. Select from names in the drop-down menu.
Example
Find running GCP instances
gcp.compute.state: RUNNING
Examples
Find GCP instances related to name
gcp.compute.zone: us-east1-d
Find GCP instances that match exact value
gcp.compute.zone: `us-east1-d`
Example
Find GCP instances with agents
gcp.compute.hasAgent: "true"
Examples
Find VM instances with key "department"
gcp.labels:(name: department)
Find VM instances that match exact key value "department"
gcp.labels:(name: 'department')
Find VM instances with key starting "dep"
gcp.labels:(name: dep*)
Examples
Find VM instances with tag value "product-management"
gcp.labels:(value: product-management)
Find VM instances that match exact key value "product-management"
gcp.labels:(value: 'product-management')
Find VM instances with tag value starting "product"
gcp.labels:(value: product*)
oci.compute.availabilityDomain
Example
Show all assets with the available domain Lhkx:US-ASHBURN-AD-1
oci.compute.availabilityDomain:"Lhkx:US-ASHBURN-AD-1"
oci.compute.canonicalRegionName
Example
Show all assets with the canonical region name us-ashburn-1
oci.compute.canonicalRegionName:"us-ashburn-1"
Example
Show assets with this OCI compartment ID
oci.compute.compartmentId:"ocid1.compartment.oc1..123452sjze35z6bkhvwjtzzgcp534zj4o75tgsizg3q36wl447jvfg6dq"
Example
Show assets with this OCI compartment name
oci.compute.compartmentName:"ocid1.compartment.abc"
Example
Show assets with display name oracle 8.
oci.compute.displayName:"oracle 8"
Example
Show all assets with fault domain FAULT-DOMAIN-1
oci.compute.faultDomain:"FAULT-DOMAIN-1"
Example
Show all findings with the host name oracle-8
oci.compute.hostName:"oracle-8"
Example
Show all assets with the ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq image ID
oci.compute.imageId:"ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq"
Example
Show assets with this OCI ID
oci.compute.ociId:"ocid1.compartment.oc1..1234567lbhcx2ajiagh57wrurvqs2ubd4ttaimgy22cxh3r6brpmmugq"
Example
Show all assets with the region us-east-1
oci.compute.region:"us-east-1"
Example
Show all assets with the region key SYD
oci.compute.regionKey:"SYD"
Example
Show all assets with the region realm OC1
oci.compute.regionRealm:"OC1"
Example
Show all assets with the shape x5-2.36.512
oci.compute.shape:"x5-2.36.512"
Example
Show all assets with the compute state Starting
oci.compute.state:STARTING
Example
Show all assets with the specific tenant ID
oci.compute.tenantId:"ocid1.tenancy.oc1..aaaaaaaax2gwhq3hszjqhte5pgzijgyge6gvlsrqar6kxn7itwhk7keokamq"
Example
Show all assets with the specific tenant name
oci.compute.tenantName:"oraclecengg1"
Example
Show findings with last check in within a specific date range.
oci.compute.timeCreated:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
oci.compute.timeCreated:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago.
Example
Show all assets with the tag key CreatedBy
oci.tags(key:CreatedBy)
Example
Show all assets with the namespace Oracle-Tags
oci.tags(namespace:"Oracle-Tags")
Example
Show all assets with the specific tag type
oci.tags(type:DEFINED)
Example
Show all assets with the tag value 2021-02-09
oci.tags(value:"2021-02-09")
Example
Show all assets with the MAC address 02:00:17:06:bd:b3
oci.vnic(macAddr:"02:00:17:06:bd:b3")
Example
Show all assets with the index 1
oci.vnic(nicIndex:1)
Example
Show all assets with this private IP
oci.vnic(privateIp:10.0.0.222)
Example
Show all assets with this public IP
oci.vnic(publicIp:10.0.0.222)
Example
Show all assets with the block 10.0.0.0/24
oci.vnic(subnetCidrBlock:10.0.0.0/24)
Example
Find OCI instances with this subnet ID
oci.vnic(subnetId: "subnet-bc02c0d4")
Example
Find OCI instances with this subnet name
oci.vnic(subnetName: "subnet-abc")
Example
Show all assets with this VCN ID
oci.vnic(vcnId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
Example
Show all assets with this vcn name
oci.vnic(vcnName:"abc")
Example
Show all assets with the router IP 10.0.0.1
oci.vnic(virtualRouterIp:10.0.0.1)
Example
Show all assets with the vlan tag 1
oci.vnic(vlanTag:1)
Example
Show all assets with the VNIC ID ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q
oci.vnic(vnicId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
Examples
Find IBM instances with name "devops"
ibm.tags.name: devops
Find IBM instances with name starting "dev"
ibm:tags.name: dev*
Find IBM instances with name ending "ops"
ibm.tags.name: *ops
Examples
Find IBM instances with tag value "dailybuild"
ibm.tags.value: dailybuild
Find IBM instances with tag value starting "daily"
ibm.tags.value: daily*
Find IBM instances with tag value ending "build"
ibm.tags.value: *build
ibm.virtualServer.datacenterId
Example
Find IBM instances with this datacenter ID
ibm.virtualServer.datacenterId: 1854895
Examples
Find IBM instances related to name
ibm.virtualServer.deviceName: "virtualserver01.Qualys-Inc.cloud"
Find IBM instances that match exact value
ibm.virtualServer.deviceName: `virtualserver01.Qualys-Inc.cloud`
Example
Show all assets with virtual server domain Qualys-Inc.cloud
ibm.virtualServer.domain:"Qualys-Inc.cloud"
Example
Show all assets with the 8998892 virtual server ID
ibm.virtualServer.id:8998892
Example
Find IBM instances in this location
ibm.virtualServer.location: westus
ibm.virtualServer.privateIpAddress
Examples
Find IBM instances with this private IP
ibm.virtualServer.privateIpAddress: 10.240.0.7
Find IBM instances with this private IP range
ibm.virtualServer.privateIpAddress: [10.240.0.7
... 10.240.0.30]
Example
Find the IBM instance with this private Vlan address
ibm.virtualServer.privateVlan: 3455
ibm.virtualServer.publicIpAddress
Examples
Find IBM instances with this public IP
ibm.virtualServer.publicIpAddress: 10.240.0.7
Find IBM instances with this public IP range
ibm.virtualServer.publicIpAddress: [10.240.0.7
... 10.240.0.30]
Example
Find the IBM instance with this public Vlan address
ibm.virtualServer.publicVlan: 3455
Example
Show assets with operating system Windows and Linux
operatingSystem: windows and operatingSystem:
linux
Example
Show assets with one of these tag names
tag.name: Cloud Agent or tag.name: HQ