Search Tokens for GCP Assets
Syntax help displayed in UI for tokens. Click each token to learn more about it.
Use these tokens when searching your Google Cloud Platform assets in the tag creation wizard (Dynamic tag > Cloud Asset Search rule).
Note:
- For all the date-related tokens, the date search is evaluated only for UTC format. The actual search results might show you the date as per your time zone.
- For the range searches, remember that the QQL search tokens are case-sensitive. Hence, make sure that you enter the correct token syntax. For more information, see Range Searches.
gcp.compute.hostnamegcp.compute.hostname
Use a text value ##### to define the hostname you're looking for.
Examples
Find GCP instances related to name
gcp.compute.hostname: instance-5.c.qvsa-dev.internal
Find GCP instances that match exact value
gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`
gcp.compute.instanceIdgcp.compute.instanceId
Use a text value ##### to define the Google Compute instance ID you're looking for.
Example
Find GCP instances with this ID
gcp.compute.instanceId: 4392196237934605253
gcp.compute.imageIdgcp.compute.imageId
Use a text value ##### to define the Google Compute image ID you're looking for.
Examples
Find GCP instances related to the Image ID
gcp.compute.imageId: projects/centos-cloud
Find GCP instances that match exact value
gcp.compute.imageId: `projects/centos-cloud/global/images/centos-6-v20191014`
gcp.compute.macAddressgcp.compute.macAddress
Use a text value ##### to define the MAC address you're interested in.
Example
Find GCP instances with this MAC address
gcp.compute.macAddress: '000D3A36DDED'
gcp.compute.machineTypegcp.compute.machineType
Use a text value ##### to define the machine type of the virtual machine instance you're interested in.
Examples
Find GCP instances related to name
gcp.compute.machineType: n1-standard-1
Find GCP instances that match exact value
gcp.compute.machineType: `n1-standard-1`
gcp.compute.networkgcp.compute.network
Use a text value ##### to find GCP instances by the VPC network the instance belongs to.
Example
Find GCP instances with this network
gcp.compute.network: 000D3A36DDED
gcp.compute.privateIpAddressgcp.compute.privateIpAddress
Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.
Examples
Find GCP instances with this private IP
gcp.compute.privateIpAddress: 10.240.0.7
Find GCP instances with this private IP range
gcp.compute.privateIpAddress: [10.240.0.7 ...
10.240.0.30]
gcp.compute.projectIdgcp.compute.projectId
Use a text value ##### to define the project ID assigned to the GCP Console project the instance belongs to.
Examples
Find GCP instances related to ID
gcp.compute.projectId: qvsa-dev
Find GCP instances that match exact value
gcp.compute.projectId: `qvsa-dev`
gcp.compute.projectNumbergcp.compute.projectNumber
Use an integer value ##### to define the project number assigned to the GCP Console project the instance belongs to.
Examples
Find GCP instances related to this number
gcp.compute.projectNumber: 1035365309337
Find GCP instances that match exact value
gcp.compute.projectNumber: `1035365309337`
gcp.compute.publicIpAddressgcp.compute.publicIpAddress
Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.
Examples
Find GCP instances with this public IP
gcp.compute.publicIpAddress: 104.196.57.216
Find GCP instances within this IP range
gcp.compute.publicIpAddress: [104.196.57.216 ...
104.196.57.218]
gcp.compute.stategcp.compute.state
Type your drop-dowSelect the name of the instance state (PENDING, RUNNING, STOPPED, TERMINATED, STOPPING, SHUTTING_DOWN, DEALLOCATED) you're interested in. Select from names in the drop-down menu.
Example
Find running GCP instances
gcp.compute.state: RUNNING
gcp.compute.zonegcp.compute.zone
Use a text value ##### to define the zone of the GCP instance you're looking for
Examples
Find GCP instances related to name
gcp.compute.zone: us-east1-d
Find GCP instances that match exact value
gcp.compute.zone: `us-east1-d`
gcp.compute.hasAgentgcp.compute.hasAgent
Use the values true | false to define whether the GCP instances you're looking for has a cloud agent installed on it.
Example
Find GCP instances with agents
gcp.compute.hasAgent: "true"
gcp.labels.namegcp.labels.name
Use a text value ##### to find VM instances with a certain GCP labels name (case insensitive).
Examples
Find VM instances with key "department"
gcp.labels:(name: department)
Find VM instances that match exact key value "department"
gcp.labels:(name: 'department')
Find VM instances with key starting "dep"
gcp.labels:(name: dep*)
gcp.labels.valuegcp.labels.value
Use a text value ##### to find VM instances with a certain GCP labels value (case insensitive).
Examples
Find VM instances with tag value "product-management"
gcp.labels:(value: product-management)
Find VM instances that match exact key value "product-management"
gcp.labels:(value: 'product-management')
Find VM instances with tag value starting "product"
gcp.labels:(value: product*)
Supported Boolean Operators
The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.
Narrow down your search by using the 'and' operator in your Boolean query. The result contains all the token values that you provide in your query.
Example
asset.status: Enrolled and asset.assetID: 122855563
The asset having the ID 122855563 and with status as Enrolled is returned in the result.
Narrow down your search by using the 'not' operator in your Boolean query. The result contains all the other values except the one that you specify after 'not' in your query.
Example
not tags.name: Windows
Assets with the Windows tag are excluded from search results.
Broaden your search by using the 'or' operator in your Boolean query. The result contains any of the token values that you provide in your query.
Example
tags.name:Cloud Agent or tags.name:Windows
The assets that have the Cloud Agent tag or the Windows tag are returned in the result.