Use these tokens in the tag creation wizard (Dynamic tag > Asset Inventory rule).
accounts.usernameaccounts.username
Example
Show findings with username administrator
accounts.username:administrator
asset.biosDescriptionasset.biosDescription
Examples
Show any findings that contain parts of description
asset.biosDescription:"American Megatrends
Inc."
Show any findings that match exact value "American Megatrends Inc."
asset.biosDescription:`American Megatrends Inc.`
Examples
Show assets created within certain dates
asset.created:[2019-01-01 ... 2019-01-15]
Show assets created starting 2019-01-15, ending 1 month ago
asset.created:[2019-
01-15
... now-1M]
Show assets created starting 2 weeks ago, ending 1 second ago
asset.created:[now-2w ... now-1s]
Show assets created on a specific date
asset.created:'2019-03-18'
Examples
Show any findings that match the beginning of any substrings within the asset name
asset.name:"ACMENVT7"
Show any findings that match exact value "ACMENVT7"
asset.name:`ACMENVT7`
asset.operationalStatusasset.operationalStatus
Example
Show assets with operational status as Repair
asset.operationalStatus: Repair
asset.environmentasset.environment
Example
Show assets with environment as Development
asset.environment: Development
asset.lastLocationasset.lastLocation
Example
Show assets with last location as Redwood City, California - United States
asset.lastLocation: 'Redwood City, California
- United States'
Example
Show assets with last location with exact string
asset.lastLocation: `Redwood City, California
- United States`
asset.lastLocation.continentasset.lastLocation.continent
Example
Show assets with last location continent as North America
asset.lastLocation.continent: North America
asset.lastLocation.countryasset.lastLocation.country
Example
Show assets with last location country as United States
asset.lastLocation.country: United States
asset.lastLocation.cityasset.lastLocation.city
Example
Show assets with last location city as Redwood City
asset.lastLocation.city: Redwood City
asset.lastLocation.postalasset.lastLocation.postal
Example
Show assets with last location postal as 94065
asset.lastLocation.postal: 94065
asset.lastLoggedOnUserasset.lastLoggedOnUser
Examples
Show assets with last logon by user asmith
asset.lastLoggedOnUser:asmith
asset.lastLocation.stateasset.lastLocation.state
Example
Show assets with last location state as California
asset.lastLocation.state: California
asset.lastUpdatedasset.lastUpdated
Examples
Show assets last updated within certain dates
asset.lastUpdated:[2019-01-01 ... 2019-01-15]
Show assets last updated starting 2019-01-15, ending 1 month ago
asset.lastUpdated:[2019-
01-15
... now-1M]
Show assets last updated starting 2 weeks ago, ending 1 second ago
asset.lastUpdated:[now-2w ... now-1s]
Show assets last updated on a specific date
asset.lastUpdated:'2019-03-18'
asset.netbiosNameasset.netbiosName
Examples
Show the asset with this name
asset.netbiosName:ACMENVT7
asset.supportGroupasset.supportGroup
Example
Show assets with support group as Compliance Managers
asset.supportGroup: Compliance Managers
Example
Show assets with this timezone
asset.timezone:"-08:00"
asset.trackingMethodasset.trackingMethod
Example
Find assets with this tracking method
asset.trackingMethod: QAGENT
asset.riskScoreasset.riskScore
Examples
Show all the assets with a risk score 900
asset.riskScore:900
Show all the assets with risk score between the range 800 to 1000
asset.riskScore:[800 ... 1000]
Show all the assets with a risk score greater than 500
asset.riskScore >500
Show all the assets with a risk score less than or equal to 800
asset.riskScore <=800
container.productcontainer.product
Example
Show Docker containers
container.product: Docker
container.versioncontainer.version
Example
Show containers of this version
container.version:1.6
asset.org.companyasset.org.company
Example
Show assets with company as ACME Italy
asset.org.company: ACME Italy
asset.org.departmentasset.org.department
Example
Show assets with department as Customer Support
asset.org.department: Customer Support
businessApp.namebusinessApp.name
Examples
Show any findings that contain parts of name
businessApp:(name:"HR Intranet")
Show any findings that match exact value "HR Intranet"
businessApp:(name:`HR Intranet`)
Examples
Show any findings that contain parts of name
hardware:"Dell Latitude e7470"
Show any findings that match exact value
hardware:`Dell Latitude e7470`
hardware.categoryhardware.category
Examples
Show any findings that match exact value
hardware.category:Printers/Laser
hardware.category1hardware.category1
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category1:Printers
hardware.category2hardware.category2
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category2:Laser
hardware.manufacturerhardware.manufacturer
Example
Show any findings that match exact value "Dell"
hardware.manufacturer:`Dell`
Example
Show any findings that match exact value "e7470"
hardware.model:`De7470`
hardware.producthardware.product
Example
Show any findings that match exact value "Latitude"
hardware.product:`Latitude`
hardware.lifecycle.stagehardware.lifecycle.stage
Example
Show End-of-Sale hardware
hardware.lifecycle.stage:"EOS"
hardware.lifecycle.eoshardware.lifecycle.eos
Examples
Show findings with hardware End-of-Sale date in this date range
hardware.lifecycle.eos:[2019-01-01 ... 2019-01-15]
Show findings with hardware End-of-Sale date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.eos:[2019-01-15 ... now-1M]
Show findings with hardware End-of-Sale date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.eos:[now-2w ... now-1s]
Show findings with this hardware End-of-Sale date
hardware.lifecycle.eos:'2019-03-18'
hardware.lifecycle.obshardware.lifecycle.obs
Examples
Show findings with hardware obsolete date in this date range
hardware.lifecycle.obs:[2019-01-01 ... 2019-01-15]
Show findings with hardware obsolete date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.obs:[2019-01-15 ... now-1M]
Show findings with hardware obsolete date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.obs:[now-2w ... now-1s]
Show findings with this hardware obsolete date
hardware.lifecycle.obs:'2019-03-18'
hardware.lifecycle.gahardware.lifecycle.ga
Examples
Show findings with hardware GA date in this date range
hardware.lifecycle.ga:[2019-01-01 ... 2019-01-15]
Show findings with hardware GA date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.ga:[2019-01-15 ... now-1M]
Show findings with hardware GA date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.ga:[now-2w ... now-1s]
Show findings with this hardware GA date
hardware.lifecycle.ga:'2019-03-18'
hardware.lifecycle.introhardware.lifecycle.intro
Examples
Show findings with hardware introduction date in this date range
hardware.lifecycle.intro:[2019-01-01 ... 2019-01-15]
Show findings with hardware introduction date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.intro:[2019-01-15 ... now-1M]
Show findings with hardware introduction date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.intro:[now-2w ... now-1s]
Show findings with this hardware introduction date
hardware.lifecycle.intro:'2019-03-18'
hardware.lifecycle.obshardware.lifecycle.obs
Examples
Show findings with hardware obsolete date in this date range
hardware.lifecycle.obs:[2019-01-01 ... 2019-01-15]
Show findings with hardware obsolete date starting 2019-01-15, ending 1 month ago
hardware.lifecycle.obs:[2019-01-15 ... now-1M]
Show findings with hardware obsolete date starting 2 weeks ago, ending 1 second ago
hardware.lifecycle.obs:[now-2w ... now-1s]
Show findings with this hardware obsolete date
hardware.lifecycle.obs:'2019-03-18'
client.interfaces.addressclient.interfaces.address
Examples
Show traffic for this IP address
client.interfaces.address:10.20.0.5
interfaces.interfaceNameinterfaces.interfaceName
Example
Show the asset with name PRO/1000
interfaces:(interfaceName:PRO/1000)
interfaces.addressinterfaces.address
Examples
Show the exact match of the IP address
interfaces:(address:`10.10.100.20`)
Show any findings that contain parts of the IP address
interfaces:(address:"10.10.100.2")
interfaces:(address: 10.10.100.2)
interfaces.gatewayAddressinterfaces.gatewayAddress
Example
Show assets with this default gateway address
interfaces:(gatewayAddress:10.11.65.1)
software.isPackagesoftware.isPackage
Example
Show software that is a package
software:(isPackage: "true")
software.isPackageComponentsoftware.isPackageComponent
Example
Show software that is a package component
software:(isPackageComponent: "true")
openPorts.detectedServiceopenPorts.detectedService
Examples
Show any findings with this service name
openPorts:(detectedService: win_remote_desktop)
Show any findings that contain parts of name
openPorts:(detectedService: "win_remote_desktop")
Show any findings that match exact value "win_remote_desktop"
openPorts:(detectedService: `win_remote_desktop`)
Example
Show assets with open port 80
openPorts:(port:80)
passiveSensor.idpassiveSensor.id
Example
Show this sensor ID
passiveSensor.id:"003687557369:1654660042:3809075:704:1654660042:3809075:704"
passiveSensor.locationpassiveSensor.location
Examples
Show assets with sensor location (appliance location label) as SanJose1
passiveSensor.location:"SanJose1"
passiveSensor.namepassiveSensor.name
Examples
Show assets with sensor name as ITCorp-appliance
passiveSensor.name:"ITCorp-appliance"
software.lifecycle.stagesoftware.lifecycle.stage
Examples
Show findings having this software lifecycle stage
software:(lifecycle.stage:eol)
Show findings having software category Windows and software lifecycle stage "active"
software:(category:Windows AND lifecycle.stage:eol)
Example
Show any findings that match exact value
services:(name:CertPropSvc
)
services.statusservices.status
Example
Show any findings that match exact value
services:(status:RUNNING
)
sensors.activatedForModulessensors.activatedForModules
Examples
Show sensors activated for VM
sensors.activatedForModules: "VM"
Show sensors activated for VM and PC
sensors.activatedForModules: "VM"
AND sensors.activatedForModules: "PC"
sensors.lastFullScansensors.lastFullScan
Examples
Show last full scan within certain dates
sensors.lastFullScan:[2019-01-01 ... 2019-01-15]
Show last full scan starting 2019-01-15, ending 1 month ago
sensors.lastFullScan:[2019-01-15 ... now-1M]
Show last full scan starting 2 weeks ago, ending 1 second ago
sensors.lastFullScan:[now-2w ... now-1s]
Show last full scan on a specific date
sensors.lastFullScan:'2019-03-18'
software.license.categorysoftware.license.category
Example
Show any findings that match exact value
software:(license.category:`Open Source`)
software.architecturesoftware.architecture
Example
Show any findings that match exact value
software.architecture:64-Bit
software.editionsoftware.edition
Example
Show any findings that match exact value
software:(edition:Professional)
software.categorysoftware.category
Example
Show any findings that match exact value
software.category:Application Development/Testing
software.category1software.category1
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category1:Application Development)
software.category2software.category2
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category2:Testing)
software.marketVersionsoftware.marketVersion
Example
Show any findings that match exact value
software:(marketVersion:7)
software.productsoftware.product
Example
Show findings with this exact product name
software:(product:Office)
software.publishersoftware.publisher
Example
Show findings with this exact software publisher
software:(publisher:Microsoft)
Example
Show findings having this software type
software.type:Installer Package
software.updatesoftware.update
Example
Show findings with this exact software update version
software:(update:16.0.1.2)
Show findings with software update version greater than 16.0.1.2
software:(update>16.0.1.2)
Show findings with software update version greater than or equal to 16.0.1.2
software:(update>=16.0.1.2)
Show findings with software update version less than 16.0.1.2
software:(update<16.0.1.2)
Show findings with software update version less than or equal to 16.0.1.2
software:(update<=16.0.1.2)
Show findings with software update version within this version range
software:(update:[16.0.1.2 ... 16.0.1.5])
software.versionsoftware.version
Example
Show findings with this exact software version
software:(version:16.0)
Show findings with software version greater than 16.0
software:(version>16.0)
Show findings with software version greater than or equal to 16.0
software:(version>=16.0)
Show findings with software version less than 16.0
software:(version<16.0)
Show findings with software version less than or equal to 16.0
software:(version<=16.0)
Show findings with software version within this version range
software:(version:[16.0 ... 20.0])
software.lifecycle.gasoftware.lifecycle.ga
Examples
Show findings with software GA date in this date range
software:(lifecycle.ga:[2019-01-01 ... 2019-01-15])
Show findings with woftware GA date starting 2019-01-15, ending 1 month ago
software:(lifecycle.ga:[2019-01-15 ... now-1M])
Show findings with software GA date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.ga:[now-2w ... now-1s])
Show findings with this software GA date
software:(lifecycle.ga:'2019-03-18')
software.lifecycle.eolsoftware.lifecycle.eol
Examples
Show findings with software End-of-Life date in this date range
software:(lifecycle.eol:[2019-01-01 ... 2019-01-15])
Show findings with software End-of-Life date starting 2019-01-15, ending 1 month ago
software:(lifecycle.eol:[2019-01-15 ... now-1M])
Show findings with software End-of-Life date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.eol:[now-2w ... now-1s])
Show findings with this software End-of-Life date
software:(lifecycle.eol:'2019-03-18')
software.lifecycle.eossoftware.lifecycle.eos
Examples
Show findings with software End-of-Support date in this date range
software:(lifecycle.eos:[2019-01-01 ... 2019-01-15])
Show findings with software End-of-Support date starting 2019-01-15, ending 1 month ago
software:(lifecycle.eos:[2019-01-15 ... now-1M])
Show findings with software End-of-Support date starting 2 weeks ago, ending 1 second ago
software:(lifecycle.eos:[now-2w ... now-1s])
Show findings with this software End-of-Support date
software:(lifecycle.eos:'2019-03-18')
software.license.subcategorysoftware.license.subcategory
Example
Show any findings that match exact value
software:(license.subcategory:Apache 2.0)
software.firstFoundsoftware.firstFound
Examples
Show assets with software first found within certain dates
software:(firstFound: [2017-06-15 ... 2017-06-30]
)
Show assets with software first found starting 2017-06-22, ending 1 month ago
software:(firstFound: [2017-06-22 ... now-1M]
)
Show assets with software first found starting 2 weeks ago, ending 1 second ago
software:(firstFound: [now-2w ... now-1s]
)
Show assets with software first found on specific date
software:(firstFound:'2017-06-14'
)
software.componentsoftware.component
Example
Show findings with Client software component
software:(component:Client)
Examples
Show assets synced from Amazon AWS
provider: "AWS"
sensors.configurationProfilesensors.configurationProfile
Examples
Show any findings related to profile name
sensors.configurationProfile: Initial Profile
Show any findings that contain parts of the name
sensors.configurationProfile: "Initial Profile"
Show any findings that match exact value
sensors.configurationProfile: `Initial Profile`
sensors.agentActivations.keysensors.agentActivations.key
Example
Show assets with agents activated using this key
sensors.agentActivations.key: 057cc48a-8d84-48eb-add4-97a605d0567d
sensors.lastActivitysensors.lastActivity
Examples
Show findings with last activity within certain dates
sensors.lastActivity: [2016-01-01 ... 2016-01-10]
Show findings with last activity starting 2015-10-01, ending 1 month ago
sensors.lastActivity: [2015-10-01 ... now-1M]
Show findings with last activity starting 2 weeks ago, ending 1 second ago
sensors.lastActivity: [now-2w ... now-1s]
Show findings with last activity on a specific date
sensors.lastActivity:'2015-12-01'
sensors.lastCheckedInsensors.lastCheckedIn
Examples
Show findings with last check in within a specific date range.
sensors.lastCheckedIn:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
sensors.lastCheckedIn:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago
sensors.lastCheckedIn:[now-2w ... now-1s]
Show findings with last check in on a specific date
sensors.lastCheckedIn:'2020-02-11'
Show findings with last check in before (older than) last 30 days.
sensors.lastCheckedIn<now-30d
Note: We recommend not to use the NOT operator in your range search to form a query like NOT sensors.lastCheckedIn:[now-30d...now-2s]. See 'QQL Best Practices' topic in the Unified Dashboard online Help.
Show findings with last check in within last 30 days excluding day 30
sensors.lastCheckedIn>now-30d
Show findings with last check in within last 30 days including day 30
sensors.lastCheckedIn>=now-30d
Show findings with last check in which is older than last 30 days excluding day 30
sensors.lastCheckedIn<now-30d
Show findings with last check in which is older than last 30 days including day 30
sensors.lastCheckedIn<=now-30d
sensors.lastInventorysensors.lastInventory
Examples
Show findings with last inventory scan within certain dates
sensors.lastInventory: [2018-06-01 ... 2018-06-10]
Show findings with last inventory scan on specific date
sensors.lastInventory:'2018-07-25'
sensors.lastVmScansensors.lastVmScan
Examples
Show last VM scan within certain dates
sensors.lastVmScan:[2019-01-01 ... 2019-01-15]
Show last VM scan starting 2019-01-15, ending 1 month ago
sensors.lastVmScan:[2019-01-15 ... now-1M]
Show last VM scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScan:[now-2w ... now-1s]
Show last VM scan on a specific date
sensors.lastVmScan:'2019-03-18'
sensors.lastVmScanDatesensors.lastVmScanDate
Examples
Show findings with last vulnerability scan within certain dates
sensors.lastVmScanDate: [2017-01-01 ... 2017-02-10]
Show findings with last vulnerability scan starting 2016-11-01, ending 1 month ago
sensors.lastVmScanDate: [2016-11-01 ... now-1M]
Show findings with last vulnerability scan starting 2 weeks ago, ending 1 second ago
sensors.lastVmScanDate: [now-2w ... now-1s]
Show findings with last vulnerability scan on specific date
sensors.lastVmScanDate:'2017-04-10'
sensors.lastComplianceScanDatesensors.lastComplianceScanDate
Examples
Show findings with last compliance scan within certain dates
sensors.lastComplianceScanDate: [2017-01-01 ...
2017-03-31]
Show findings with last compliance scan starting 2016-10-15, ending 1 month ago
sensors.lastComplianceScanDate: [2016-10-15 ...
now-1M]
Show findings with last compliance scan starting 2 weeks ago, ending 1 second ago
sensors.lastComplianceScanDate: [now-2w ... now-1s]
Show findings with last compliance scan on specific date
sensors.lastComplianceScanDate:'2017-02-18'
aws.ec2.accountIdaws.ec2.accountId
Examples
Find EC2 instances that match this account ID
aws.ec2.accountId: 123456789012
Find EC2 instances with account ID starting "12345"
aws.ec2.accountId: 12345*
Find EC2 instances where account ID is null (remove the colon)
aws.ec2.accountId is null
aws.ec2.availabilityZoneaws.ec2.availabilityZone
Example
Find EC2 instances in the us-east-1a availability zone
aws.ec2.availabilityZone: us-east-1a
aws.ec2.hasAgentaws.ec2.hasAgent
Examples
Show findings with a cloud agent
aws.ec2.hasAgent: true
Show findings without a cloud agent
aws.ec2.hasAgent: false
aws.ec2.hostnameaws.ec2.hostname
Examples
Find instances related to name
aws.ec2.hostname: abc.qualys.com
Find instances that match exact value
aws.ec2.hostname: `abc.qualys.com`
aws.ec2.imageIdaws.ec2.imageId
Examples
Find instances related to the Image ID
aws.ec2.imageId: ami-2ea83347
Find instances that match exact value
aws.ec2.imageId: `ami-2ea83347`
aws.ec2.instanceIdaws.ec2.instanceId
Example
Find EC2 instances with this ID
aws.ec2.instanceId: i-1234567890abcdef0
aws.ec2.instanceStateaws.ec2.instanceState
Example
Find running EC2 instances
aws.ec2.instanceState: RUNNING
aws.ec2.instanceTypeaws.ec2.instanceType
Example
Find EC2 instances with instance type t2.micro
aws.ec2.instanceType: t2.micro
aws.ec2.isQualysScanneraws.ec2.isQualysScanner
Examples
Show findings where assets are scanners
aws.ec2.isQualysScanner: true
Show findings where assets are not scanners
aws.ec2.isQualysScanner: false
aws.ec2.kernelIdaws.ec2.kernelId
Example
Find EC2 instances with this kernel ID
aws.ec2.kernelId: aki-70ab0c10
aws.ec2.launchDateaws.ec2.launchDate
Examples
Find EC2 instances launched within certain dates
aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]
Find EC2 instances launched on specific date
aws.ec2.launchDate:'2017-08-15'
aws.ec2.privateDNSaws.ec2.privateDNS
Example
Find the EC2 instance with this private DNS address
aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal
aws.ec2.privateIpAddressaws.ec2.privateIpAddress
Examples
Find EC2 instances with this private IP address
aws.ec2.privateIpAddress: 10.90.0.119
Find EC2 instances within this IP range
aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]
aws.ec2.publicDNSaws.ec2.publicDNS
Example
Find the EC2 instance with this public DNS address
aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com
aws.ec2.publicIpAddressaws.ec2.publicIpAddress
Examples
Find EC2 instances with this public IP address
aws.ec2.publicIpAddress: 52.70.141.154
Find EC2 instances within this IP range
aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]
aws.ec2.region.codeaws.ec2.region.code
Example
Find EC2 instances in the us-east-1 region
aws.ec2.region.code: us-east-1
aws.ec2.region.nameaws.ec2.region.name
Example
Find EC2 instances in the US East (N. Virginia) region
aws.ec2.region.name: US East (N. Virginia)
aws.ec2.spotInstanceaws.ec2.spotInstance
Examples
Show EC2 Spot instances
aws.ec2.spotInstance: "true"
Show EC2 instances that are not Spot instances
aws.ec2.spotInstance: "false"
aws.ec2.subnetIdaws.ec2.subnetId
Example
Find EC2 instances with this subnet ID
aws.ec2.subnetId: subnet-bc02c0d4
Example
Find EC2 instances with this VPC ID
aws.ec2.vpcId: vpc-1e37cd76
azure.vm.imageOfferazure.vm.imageOffer
Examples
Find Azure instances related to name
azure.vm.imageOffer: UbuntuServer
Find Azure instances that match exact value
azure.vm.imageOffer: `UbuntuServer`
azure.vm.imagePublisherazure.vm.imagePublisher
Examples
Find Azure instances related to name
azure.vm.imagePublisher: Canonical
Find Azure instances that match exact value
azure.vm.imagePublisher: `Canonical`
azure.vm.imageVersionazure.vm.imageVersion
Example
Find Azure instances with this sku version
azure.vm.imageVersion: 16.04.201708030
azure.vm.locationazure.vm.location
Example
Find Azure instances in this location
azure.vm.location: westus
azure.vm.macAddressazure.vm.macAddress
Example
Find Azure instances with this MAC address
azure.vm.macAddress: '000D3A36DDED'
Examples
Find Azure instances related to name
azure.vm.name: avset2
Find Azure instances that match exact value
azure.vm.name: `avset2`
azure.vm.platformazure.vm.platform
Example
Find Azure instances on Windows platform
azure.vm.platform: Windows
azure.vm.privateIpAddressazure.vm.privateIpAddress
Examples
Find Azure instances with this private IP
azure.vm.privateIpAddress: 10.1.2.5
Find Azure instances within this IP range
azure.vm.privateIpAddress: [10.1.2.5 ... 10.1.2.33]
azure.vm.publicIpAddressazure.vm.publicIpAddress
Examples
Find Azure instances with this public IP
azure.vm.publicIpAddress: 13.126.125.189
Find Azure instances within this IP range
azure.vm.publicIpAddress: [13.126.125.180 ...
13.126.125.255]
azure.vm.resourceGroupNameazure.vm.resourceGroupName
Examples
Find Azure instances related to name
azure.vm.resourceGroupName: my-eastus-rg
Find Azure instances that match exact value
azure.vm.resourceGroupName: `my-eastus-rg`
Example
Find Azure instances with this size
azure.vm.size: Standard_D1
Example
Find running Azure instances
azure.vm.state: RUNNING
azure.vm.subnetazure.vm.subnet
Example
Find Azure instances with this subnet
azure.vm.subnet: 10.1.2.0
azure.vm.subscriptionIdazure.vm.subscriptionId
Example
Find Azure instances with this subscription ID
azure.vm.subscriptionId: fbb9ea64-abda-452e-adfa-83442409
azure.vm.virtualNetworkazure.vm.virtualNetwork
Examples
Find Azure instances related to virtual network
azure.vm.virtualNetwork: cli-vnet
Find Azure instances that match exact value of virtual network
azure.vm.virtualNetwork: `cli-vnet`
Example
Find Azure instances with this ID
azure.vm.vmId: 13f56399-bd52-4150-9748-7190aae1ff21
azure.vm.hasAgentazure.vm.hasAgent
Example
Find Azure instances with agents
azure.vm.hasAgent: "true"
gcp.compute.hostnamegcp.compute.hostname
Examples
Find GCP instances related to name
gcp.compute.hostname: instance-5.c.qvsa-dev.internal
Find GCP instances that match exact value
gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`
gcp.compute.instanceIdgcp.compute.instanceId
Example
Find GCP instances with this ID
gcp.compute.instanceId: 4392196237934605253
gcp.compute.macAddressgcp.compute.macAddress
Example
Find GCP instances with this MAC address
gcp.compute.macAddress: '000D3A36DDED'
gcp.compute.machineTypegcp.compute.machineType
Examples
Find GCP instances related to name
gcp.compute.machineType: n1-standard-1
Find GCP instances that match exact value
gcp.compute.machineType: `n1-standard-1`
gcp.compute.networkgcp.compute.network
Example
Find GCP instances with this network
gcp.compute.network: 000D3A36DDED
gcp.compute.privateIpAddressgcp.compute.privateIpAddress
Examples
Find GCP instances with this private IP
gcp.compute.privateIpAddress: 10.240.0.7
Find GCP instances with this private IP range
gcp.compute.privateIpAddress: [10.240.0.7 ...
10.240.0.30]
gcp.compute.projectIdgcp.compute.projectId
Examples
Find GCP instances related to ID
gcp.compute.projectId: qvsa-dev
Find GCP instances that match exact value
gcp.compute.projectId: `qvsa-dev`
gcp.compute.projectNumbergcp.compute.projectNumber
Examples
Find GCP instances related to this number
gcp.compute.projectNumber: 1035365309337
Find GCP instances that match exact value
gcp.compute.projectNumber: `1035365309337`
gcp.compute.publicIpAddressgcp.compute.publicIpAddress
Examples
Find GCP instances with this public IP
gcp.compute.publicIpAddress: 104.196.57.216
Find GCP instances within this IP range
gcp.compute.publicIpAddress: [104.196.57.216 ...
104.196.57.218]
gcp.compute.stategcp.compute.state
Type your drop-dowSelect the name of the instance state (PENDING, RUNNING, STOPPED, TERMINATED, STOPPING, SHUTTING_DOWN, DEALLOCATED) you're interested in. Select from names in the drop-down menu.
Example
Find running GCP instances
gcp.compute.state: RUNNING
gcp.compute.zonegcp.compute.zone
Examples
Find GCP instances related to name
gcp.compute.zone: us-east1-d
Find GCP instances that match exact value
gcp.compute.zone: `us-east1-d`
gcp.compute.hasAgentgcp.compute.hasAgent
Example
Find GCP instances with agents
gcp.compute.hasAgent: "true"
gcp.labels.namegcp.labels.name
Examples
Find VM instances with key "department"
gcp.labels:(name: department)
Find VM instances that match exact key value "department"
gcp.labels:(name: 'department')
Find VM instances with key starting "dep"
gcp.labels:(name: dep*)
gcp.labels.valuegcp.labels.value
Examples
Find VM instances with tag value "product-management"
gcp.labels:(value: product-management)
Find VM instances that match exact key value "product-management
"
gcp.labels:(value: 'product-management')
Find VM instances with tag value starting "product"
gcp.labels:(value: product*)
oci.compute.availabilityDomainoci.compute.availabilityDomain
Example
Show all assets with the available domain Lhkx:US-ASHBURN-AD-1
oci.compute.availabilityDomain:"Lhkx:US-ASHBURN-AD-1"
oci.compute.canonicalRegionNameoci.compute.canonicalRegionName
Example
Show all assets with the canonical region name us-ashburn-1
oci.compute.canonicalRegionName:"us-ashburn-1"
oci.compute.compartmentIdoci.compute.compartmentId
Example
Show assets with this OCI compartment ID
oci.compute.compartmentId:"ocid1.compartment.oc1..123452sjze35z6bkhvwjtzzgcp534zj4o75tgsizg3q36wl447jvfg6dq"
oci.compute.compartmentNameoci.compute.compartmentName
Example
Show assets with this OCI compartment name
oci.compute.compartmentName:"ocid1.compartment.abc"
oci.compute.displayNameoci.compute.displayName
Example
Show assets with display name oracle 8.
oci.compute.displayName:"oracle 8"
oci.compute.faultDomainoci.compute.faultDomain
Example
Show all assets with fault domain FAULT-DOMAIN-1
oci.compute.faultDomain:"FAULT-DOMAIN-1"
oci.compute.hostNameoci.compute.hostName
Example
Show all findings with the host name oracle-8
oci.compute.hostName:"oracle-8"
oci.compute.imageIdoci.compute.imageId
Example
Show all assets with the ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq image ID
oci.compute.imageId:"ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq"
oci.compute.ociIdoci.compute.ociId
Example
Show assets with this OCI ID
oci.compute.ociId:"ocid1.compartment.oc1..1234567lbhcx2ajiagh57wrurvqs2ubd4ttaimgy22cxh3r6brpmmugq"
oci.compute.regionoci.compute.region
Example
Show all assets with the region us-east-1
oci.compute.region:"us-east-1"
oci.compute.regionKeyoci.compute.regionKey
Example
Show all assets with the region key SYD
oci.compute.regionKey:"SYD"
oci.compute.regionRealmoci.compute.regionRealm
Example
Show all assets with the region realm OC1
oci.compute.regionRealm:"OC1"
oci.compute.shapeoci.compute.shape
Example
Show all assets with the shape x5-2.36.512
oci.compute.shape:"x5-2.36.512"
oci.compute.stateoci.compute.state
Example
Show all assets with the compute state Starting
oci.compute.state:STARTING
oci.compute.tenantIdoci.compute.tenantId
Example
Show all assets with the specific tenant ID
oci.compute.tenantId:"ocid1.tenancy.oc1..aaaaaaaax2gwhq3hszjqhte5pgzijgyge6gvlsrqar6kxn7itwhk7keokamq"
oci.compute.tenantNameoci.compute.tenantName
Example
Show all assets with the specific tenant name
oci.compute.tenantName:"oraclecengg1"
oci.compute.timeCreatedoci.compute.timeCreated
Example
Show findings with last check in within a specific date range.
oci.compute.timeCreated:[2020-01-01 ... 2020-01-10]
Show findings with last check in starting 2019-11-01, ending 1 month ago.
oci.compute.timeCreated:[2019-11-01 ... now-1M]
Show findings with last check in starting 2 weeks ago, ending 1 second ago.
oci.vnic.macAddroci.vnic.macAddr
Example
Show all assets with the MAC address 02:00:17:06:bd:b3
oci.vnic(macAddr:"02:00:17:06:bd:b3")
oci.vnic.nicIndexoci.vnic.nicIndex
Example
Show all assets with the index 1
oci.vnic(nicIndex:1)
oci.vnic.privateIpoci.vnic.privateIp
Example
Show all assets with this private IP
oci.vnic(privateIp:10.0.0.222)
oci.vnic.publicIpoci.vnic.publicIp
Example
Show all assets with this public IP
oci.vnic(publicIp:10.0.0.222)
oci.vnic.subnetCidrBlockoci.vnic.subnetCidrBlock
Example
Show all assets with the block 10.0.0.0/24
oci.vnic(subnetCidrBlock:10.0.0.0/24)
oci.vnic.subnetIdoci.vnic.subnetId
Example
Find OCI instances with this subnet ID
oci.vnic(subnetId: "subnet-bc02c0d4")
oci.vnic.subnetNameoci.vnic.subnetName
Example
Find OCI instances with this subnet name
oci.vnic(subnetName: "subnet-abc")
Example
Show all assets with this VCN ID
oci.vnic(vcnId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
oci.vnic.vcnNameoci.vnic.vcnName
Example
Show all assets with this vcn name
oci.vnic(vcnName:"abc")
oci.vnic.virtualRouterIpoci.vnic.virtualRouterIp
Example
Show all assets with the router IP 10.0.0.1
oci.vnic(virtualRouterIp:10.0.0.1)
oci.vnic.vlanTagoci.vnic.vlanTag
Example
Show all assets with the vlan tag 1
oci.vnic(vlanTag:1)
oci.vnic.vnicIdoci.vnic.vnicId
Example
Show all assets with the VNIC ID ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q
oci.vnic(vnicId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
ibm.virtualServer.datacenterIdibm.virtualServer.datacenterId
Example
Find IBM instances with this datacenter ID
ibm.virtualServer.datacenterId: 1854895
ibm.virtualServer.deviceNameibm.virtualServer.deviceName
Examples
Find IBM instances related to name
ibm.virtualServer.deviceName: "virtualserver01.Qualys-Inc.cloud"
Find IBM instances that match exact value
ibm.virtualServer.deviceName: `virtualserver01.Qualys-Inc.cloud`
ibm.virtualServer.domainibm.virtualServer.domain
Example
Show all assets with virtual server domain Qualys-Inc.cloud
ibm.virtualServer.domain:"Qualys-Inc.cloud"
ibm.virtualServer.idibm.virtualServer.id
Example
Show all assets with the 8998892 virtual server ID
ibm.virtualServer.id:8998892
ibm.virtualServer.locationibm.virtualServer.location
Example
Find IBM instances in this location
ibm.virtualServer.location: westus
ibm.virtualServer.privateIpAddressibm.virtualServer.privateIpAddress
Examples
Find IBM instances with this private IP
ibm.virtualServer.privateIpAddress: 10.240.0.7
Find IBM instances with this private IP range
ibm.virtualServer.privateIpAddress: [10.240.0.7
... 10.240.0.30]
ibm.virtualServer.privateVlanibm.virtualServer.privateVlan
Example
Find the IBM instance with this private Vlan address
ibm.virtualServer.privateVlan: 3455
ibm.virtualServer.publicIpAddressibm.virtualServer.publicIpAddress
Examples
Find IBM instances with this public IP
ibm.virtualServer.publicIpAddress: 10.240.0.7
Find IBM instances with this public IP range
ibm.virtualServer.publicIpAddress: [10.240.0.7
... 10.240.0.30]
ibm.virtualServer.publicVlanibm.virtualServer.publicVlan
Example
Find the IBM instance with this public Vlan address
ibm.virtualServer.publicVlan: 3455
Example
Show assets with operating system Windows and Linux
operatingSystem: windows and operatingSystem:
linux
Example
Show assets with one of these tag names
tag.name: Cloud Agent or tag.name: HQ