Learn more about Nested Queries

Best Practices

Use nested queries when tokens have a shared key, in this example "asset".

asset:(assetID:43954857 AND cpuCount:2)

 

Consider the intent of your query. Here's some examples.

Query 1: This will return findings having a certain agent ID and last logged on user. A finding is returned only when it matches both criteria.

asset:(agentID:123456789 AND lastLoggedOnUser:jrbilles)

Query 2: This will return findings having a certain agent ID and/or a certain last logged on user. A finding is returned when it matches only one criteria.

asset.agentID:123456789 AND lastLoggedOnUser:jrbilles