Use these tokens in the tag creation wizard (Dynamic tag > Asset Inventory rule).
Note:
- For all the date-related tokens, the date search is evaluated only for UTC format. The actual search results might show you the date as per your time zone.
- For the range searches, remember that the QQL search tokens are case-sensitive. Hence, make sure that you enter the correct token syntax. For more information, see Range Searches.
- The <, >, <=, >=, == operators are supported only for QQL tokens with the numeric data type. Note that they are not supported for QQL tokens with string data types.
accounts.usernameaccounts.username
Example
Show findings with username administrator
accounts.username:administrator
asset.biosDescriptionasset.biosDescription
Examples
Show any findings that contain parts of description
asset.biosDescription:"American Megatrends Inc."
Show any findings that match exact value "American Megatrends Inc."
asset.biosDescription:`American Megatrends Inc.`
Examples
Show any findings that match the beginning of any substrings within the asset name
asset.name:"ACMENVT7"
Show any findings that match exact value "ACMENVT7"
asset.name:`ACMENVT7`
asset.domainRoleasset.domainRole
Examples
Show any findings that contain parts of name
asset.domainRole:"Member Ser"
Show any findings that match exact value "Member Server"
asset.domainRole:`Member Server`
asset.lastLocation.continentasset.lastLocation.continent
Example
Show assets with last location continent as North America
asset.lastLocation.continent: North America
asset.lastLocation.countryasset.lastLocation.country
Example
Show assets with last location country as United States
asset.lastLocation.country: United States
asset.lastLocation.cityasset.lastLocation.city
Example
Show assets with last location city as Redwood City
asset.lastLocation.city: Redwood City
asset.lastLocation.postalasset.lastLocation.postal
Example
Show assets with last location postal as 94065
asset.lastLocation.postal: 94065
asset.lastLoggedOnUserasset.lastLoggedOnUser
Examples
Show assets with last logon by user asmith
asset.lastLoggedOnUser:asmith
asset.lastLocation.stateasset.lastLocation.state
Example
Show assets with last location state as California
asset.lastLocation.state: California
asset.netbiosNameasset.netbiosName
Examples
Show the asset with this name
asset.netbiosName:ACMENVT7
asset.trackingMethodasset.trackingMethod
Example
Find assets with this tracking method
asset.trackingMethod: QAGENT
asset.riskScoreasset.riskScore
Note:
- This QQL token is now deprecated and may be visible to limited users during the withdrawal phase.
- You can't create tags using this token in combination with other QQL tokens. Refer to the following example:
asset.riskScore >500 and operatingSystem:"Windows"
Examples
Show all the assets with a risk score 900
asset.riskScore:900
Show all the assets with risk score between the range 800 to 1000
asset.riskScore:[800 ... 1000]
Show all the assets with a risk score greater than 500
asset.riskScore >500
Show all the assets with a risk score less than or equal to 800
asset.riskScore <=800
Examples
Show assets that match the exact value of the domain
asset.domain: `qualys.com`
Show assets that contain parts of the domain
asset.domain: "qualys."
asset.subdomainasset.subdomain
Examples
Show assets that match the exact value of the subdomains
asset.subdomain: `doc.qualys.com`
Show assets that contain the parts of the subdomains
asset.subdomain: "doc.qualys."
Example
Show the asset with this FQDN
asset.fqdn:ACMENVT7.acme.com
asset.hostingCategory1asset.hostingCategory1
Example
Show findings with hosting catagory CDN
asset.hostingCategory1:"CDN"
Examples
Show assets details that match the exact value of the organization name
asset.org.name: `Qualys, Inc.`
Show assets details that contain parts of the organization name
asset.org.name: "Qualys,"
Examples
Show assets that match the exact ISP name
asset.isp: `amazon.com, Inc.`
Show assets that are with the parts of the ISP name
asset.isp: "amazon.com,"
Examples
Show assets that match the exact value of ASN
asset.asn: `AS8075`
Show assets that are with the parts of the ASN
asset.asn: "AS807"
customAttributes.connectorIdcustomAttributes.connectorId
Example
Find assets for connector 'Qualys'
customAttributes:(connectorId:0)
customAttributes.keycustomAttributes.key
Example
Find assets with "Department" as part of the key name
customAttributes:(key:"Department")
The result includes assets with the 'Department' custom attribute key.
Note: If 'Department' is part of the key name, such as Department 1, Department A-C, or Department US, those assets are also included in the result.
customAttributes.valuecustomAttributes.value
Example
Find assets with "DEVOPS" as part of the key value
customAttributes:(value:"DEVOPS")
The result includes assets with the 'DEVOPS' custom attribute value.
Note: If 'DEVOPS' is part of the value name, such as DEVOPS CSAM, DEVOPS CA, or DEVOPS PM, those assets are also included in the result.
whoIs.registrantEmailIdwhoIs.registrantEmailId
Examples
Show all the assets for which the exact registrant email id of the domain or subdomain matches
whoIs:(registrantEmailId: `66aab8e6ace-49101@contact.qualys.net`)
Show all the assets for which the part of the registrant email id of the domain or subdomain matches
whoIs:(registrantEmailId: "66aab8e6ace-49101@contact.qualys.net")
whoIs.registrantOrgwhoIs.registrantOrg
Examples
Show all the assets for which the exact registrant organization of domain/subdomain matches
whoIs:(registrantOrg: `Qualys, Inc`)
Show all the assets for which the part of the registrant organization of domain/subdomain matches
whoIs:(registrantOrg: "Qualys,")
whoIs.registrarwhoIs.registrar
Examples
Show all the assets for which the exact registrar matches
whoIs:(registrar: `abc net`)
Show all assets for which the part of the registrar matches
whoIs:(registrar: "abc net")
Examples
Show any findings that contain parts of name
hardware:"Dell Latitude e7470"
Show any findings that match exact value
hardware:`Dell Latitude e7470`
hardware.categoryhardware.category
Examples
Show any findings that match exact value
hardware.category:Printers/Laser
hardware.category1hardware.category1
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category1:Printers
hardware.category2hardware.category2
Example
If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.
Show any findings that match exact value
hardware.category2:Laser
hardware.manufacturerhardware.manufacturer
Example
Show any findings that match exact value "Dell"
hardware.manufacturer:`Dell`
Example
Show any findings that match exact value "e7470"
hardware.model:`De7470`
hardware.producthardware.product
Example
Show any findings that match exact value "Latitude"
hardware.product:`Latitude`
hardware.lifecycle.stagehardware.lifecycle.stage
Example
Show End-of-Sale hardware
hardware.lifecycle.stage:"EOS"
inventory:(sourceinventory:(source
Examples
Show findings from cloud agents
inventory:(source: Cloud Agent)
Show findings from Passive Sensor
inventory:(source: Passive Sensor)
interfaces:(addressinterfaces:(address
Examples
Show the exact match of the IP address
interfaces:(address:`10.10.100.20`)
Show any findings that contain parts of the IP address
interfaces:(address:"10.10.100.2")
interfaces:(address: 10.10.100.2)
interfaces:(hostnameinterfaces:(hostname
Examples
Show any findings related to name
interfaces:(hostname: xpsp2-jp-26-111)
Show any findings that contain parts of name
interfaces:(hostname: "xpsp2-jp-26-111")
Show any findings that match exact value "xpsp2-jp-26-111"
interfaces:(hostname: `xpsp2-jp-26-111`)
Show any findings related to name (we'll match super domains)
interfaces:(hostname: qcentos71sqp3.rdlab.acme.com)
Show any findings that match exact value "qcentos71sqp3.rdlab.acme.com"
interfaces:(hostname: `qcentos71sqp3.rdlab.acme.com`)
Show findings according to values entered in the square brackets.
Note: You can add multiple values in []. However, it's important to understand that partial values are not supported. You must enter the exact match value.
Example with correct syntax - interfaces:(hostname: [win7-181, bridge.vuln.qa.qualys.com])
Example with incorrect syntax - interfaces:(hostname: [win7, bridge.vuln.qa])
interfaces:(gatewayAddressinterfaces:(gatewayAddress
Example
Show assets with this default gateway address
interfaces:(gatewayAddress:10.11.65.1)
interfaces:(interfaceNameinterfaces:(interfaceName
Example
Show the asset with name PRO/1000
interfaces:(interfaceName:PRO/1000)
software:(isPackagesoftware:(isPackage
Example
Show software that is a package
software:(isPackage:"true")
software:(isPackageComponentsoftware:(isPackageComponent
Example
Show software that is a package component
software:(isPackageComponent:"true")
openPorts.detectedServiceopenPorts.detectedService
Examples
Show any findings with this service name
openPorts:(detectedService: win_remote_desktop)
Show any findings that contain parts of name
openPorts:(detectedService: "win_remote_desktop")
Show any findings that match exact value "win_remote_desktop"
openPorts:(detectedService: `win_remote_desktop`)
Example
Show assets with open port 80
openPorts:(port:80)
passiveSensor.idpassiveSensor.id
Example
Show this sensor ID
passiveSensor.id:"003687557369:1654660042:3809075:704:1654660042:3809075:704"
passiveSensor.locationpassiveSensor.location
Examples
Show assets with sensor location (appliance location label) as SanJose1
passiveSensor.location:"SanJose1"
passiveSensor.namepassiveSensor.name
Examples
Show assets with sensor name as ITCorp-appliance
passiveSensor.name:"ITCorp-appliance"
software:(lifecycle.stagesoftware:(lifecycle.stage
Examples
Show findings having this software lifecycle stage
software:(lifecycle.stage:eol)
Show findings having software category Windows and software lifecycle stage "active"
software:(category:Windows AND lifecycle.stage:eol)
Example
Show any findings that match exact value
services:(name:CertPropSvc
)
services.statusservices.status
Example
Show any findings that match exact value
services:(status:RUNNING
)
software:(license.categorysoftware:(license.category
Example
Show any findings that match exact value
software:(license.category:`Open Source`)
software:(architecturesoftware:(architecture
Example
Show any findings that match exact value
software:(architecture:64-Bit)
software:(editionsoftware:(edition
Example
Show any findings that match exact value
software:(edition:Professional)
software:(categorysoftware:(category
Example
Show any findings that match exact value
software:(category: Application Development/Testing)
software:(category1software:(category1
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category1:Application Development)
software:(category2software:(category2
Example
If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.
Show any findings that match exact value
software:(category2:Testing)
software:(marketVersionsoftware:(marketVersion
Example
Show any findings that match exact value
software:(marketVersion:7)
Examples
Show any findings with this name
software:(name:VMware Tools)
Show any findings that contain parts of name
software:(name:"VMware Tools")
Show any findings that match exact value
software:(name:`VMware Tools`)
Find assets with certain tag and software installed
tags.name: `Cloud Agent` AND software: (name: `Cisco AnyConnect Secure Mobility Client` AND version: `3.1.12345`)
software:(productsoftware:(product
Example
Show findings with this exact product name
software:(product:Office)
software:(publishersoftware:(publisher
Example
Show findings with this exact software publisher
software:(publisher:Microsoft)
software:(updatesoftware:(update
Example
Show findings with this exact software update version
software:(update:16.0.1.2)
Show findings with software update version within this version range
software:(update:[16.0.1.2 ... 16.0.1.5])
software:(versionsoftware:(version
Example
Show findings with this exact software version
software:(version:16.0)
Show findings with software version within this version range
software:(version:[16.0 ... 20.0])
software:(componentsoftware:(component
Example
Show findings with Client software component
software:(component:Client)
Examples
Show assets synced from Amazon AWS
provider: "AWS"
aws.ec2.accountIdaws.ec2.accountId
Examples
Find EC2 instances that match this account ID
aws.ec2.accountId: 123456789012
Find EC2 instances with account ID starting "12345"
aws.ec2.accountId: 12345*
Find EC2 instances where account ID is null (remove the colon)
aws.ec2.accountId is null
aws.ec2.availabilityZoneaws.ec2.availabilityZone
Example
Find EC2 instances in the us-east-1a availability zone
aws.ec2.availabilityZone: us-east-1a
aws.ec2.hasAgentaws.ec2.hasAgent
Examples
Show findings with a cloud agent
aws.ec2.hasAgent: true
Show findings without a cloud agent
aws.ec2.hasAgent: false
aws.ec2.hostnameaws.ec2.hostname
Examples
Find instances related to name
aws.ec2.hostname: abc.qualys.com
Find instances that match exact value
aws.ec2.hostname: `abc.qualys.com`
aws.ec2.imageIdaws.ec2.imageId
Examples
Find instances related to the Image ID
aws.ec2.imageId: ami-2ea83347
Find instances that match exact value
aws.ec2.imageId: `ami-2ea83347`
aws.ec2.instanceIdaws.ec2.instanceId
Example
Find EC2 instances with this ID
aws.ec2.instanceId: i-1234567890abcdef0
aws.ec2.instanceStateaws.ec2.instanceState
Example
Find running EC2 instances
aws.ec2.instanceState: RUNNING
aws.ec2.instanceTypeaws.ec2.instanceType
Example
Find EC2 instances with instance type t2.micro
aws.ec2.instanceType: t2.micro
aws.ec2.launchDateaws.ec2.launchDate
Examples
Find EC2 instances launched within certain dates
aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]
Find EC2 instances launched on specific date
aws.ec2.launchDate:'2017-08-15'
aws.ec2.privateDNSaws.ec2.privateDNS
Example
Find the EC2 instance with this private DNS address
aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal
aws.ec2.privateIpAddressaws.ec2.privateIpAddress
Examples
Find EC2 instances with this private IP address
aws.ec2.privateIpAddress: 10.90.0.119
Find EC2 instances within this IP range
aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]
aws.ec2.publicDNSaws.ec2.publicDNS
Example
Find the EC2 instance with this public DNS address
aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com
aws.ec2.publicIpAddressaws.ec2.publicIpAddress
Examples
Find EC2 instances with this public IP address
aws.ec2.publicIpAddress: 52.70.141.154
Find EC2 instances within this IP range
aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]
aws.ec2.region.codeaws.ec2.region.code
Example
Find EC2 instances in the us-east-1 region
aws.ec2.region.code: us-east-1
aws.ec2.region.nameaws.ec2.region.name
Example
Find EC2 instances in the US East (N. Virginia) region
aws.ec2.region.name: US East (N. Virginia)
aws.ec2.spotInstanceaws.ec2.spotInstance
Examples
Show EC2 Spot instances
aws.ec2.spotInstance: "true"
Show EC2 instances that are not Spot instances
aws.ec2.spotInstance: "false"
aws.ec2.subnetIdaws.ec2.subnetId
Example
Find EC2 instances with this subnet ID
aws.ec2.subnetId: subnet-bc02c0d4
Example
Find EC2 instances with this VPC ID
aws.ec2.vpcId: vpc-1e37cd76
azure.vm.imageOfferazure.vm.imageOffer
Examples
Find Azure instances related to name
azure.vm.imageOffer: UbuntuServer
Find Azure instances that match exact value
azure.vm.imageOffer: `UbuntuServer`
azure.vm.imagePublisherazure.vm.imagePublisher
Examples
Find Azure instances related to name
azure.vm.imagePublisher: Canonical
Find Azure instances that match exact value
azure.vm.imagePublisher: `Canonical`
azure.vm.imageVersionazure.vm.imageVersion
Example
Find Azure instances with this sku version
azure.vm.imageVersion: 16.04.201708030
azure.vm.locationazure.vm.location
Example
Find Azure instances in this location
azure.vm.location: westus
azure.vm.macAddressazure.vm.macAddress
Example
Find Azure instances with this MAC address
azure.vm.macAddress: '000D3A36DDED'
Examples
Find Azure instances related to name
azure.vm.name: avset2
Find Azure instances that match exact value
azure.vm.name: `avset2`
azure.vm.platformazure.vm.platform
Example
Find Azure instances on Windows platform
azure.vm.platform: Windows
azure.vm.privateIpAddressazure.vm.privateIpAddress
Examples
Find Azure instances with this private IP
azure.vm.privateIpAddress: 10.1.2.5
Find Azure instances within this IP range
azure.vm.privateIpAddress: [10.1.2.5 ... 10.1.2.33]
azure.vm.publicIpAddressazure.vm.publicIpAddress
Examples
Find Azure instances with this public IP
azure.vm.publicIpAddress: 13.126.125.189
Find Azure instances within this IP range
azure.vm.publicIpAddress: [13.126.125.180 ...
13.126.125.255]
azure.vm.resourceGroupNameazure.vm.resourceGroupName
Examples
Find Azure instances related to name
azure.vm.resourceGroupName: my-eastus-rg
Find Azure instances that match exact value
azure.vm.resourceGroupName: `my-eastus-rg`
Example
Find Azure instances with this size
azure.vm.size: Standard_D1
Example
Find running Azure instances
azure.vm.state: RUNNING
azure.vm.subnetazure.vm.subnet
Example
Find Azure instances with this subnet
azure.vm.subnet: 10.1.2.0
azure.vm.subscriptionIdazure.vm.subscriptionId
Example
Find Azure instances with this subscription ID
azure.vm.subscriptionId: fbb9ea64-abda-452e-adfa-83442409
azure.vm.virtualNetworkazure.vm.virtualNetwork
Examples
Find Azure instances related to virtual network
azure.vm.virtualNetwork: cli-vnet
Find Azure instances that match exact value of virtual network
azure.vm.virtualNetwork: `cli-vnet`
Example
Find Azure instances with this ID
azure.vm.vmId: 13f56399-bd52-4150-9748-7190aae1ff21
azure.vm.hasAgentazure.vm.hasAgent
Example
Find Azure instances with agents
azure.vm.hasAgent: "true"
gcp.compute.hostnamegcp.compute.hostname
Examples
Find GCP instances related to name
gcp.compute.hostname: instance-5.c.qvsa-dev.internal
Find GCP instances that match exact value
gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`
gcp.compute.imageIdgcp.compute.imageId
Examples
Find GCP instances related to the Image ID
gcp.compute.imageId: projects/centos-cloud
Find GCP instances that match exact value
gcp.compute.imageId: `projects/centos-cloud/global/images/centos-6-v20191014`
gcp.compute.instanceIdgcp.compute.instanceId
Example
Find GCP instances with this ID
gcp.compute.instanceId: 4392196237934605253
gcp.compute.macAddressgcp.compute.macAddress
Example
Find GCP instances with this MAC address
gcp.compute.macAddress: '000D3A36DDED'
gcp.compute.machineTypegcp.compute.machineType
Examples
Find GCP instances related to name
gcp.compute.machineType: n1-standard-1
Find GCP instances that match exact value
gcp.compute.machineType: `n1-standard-1`
gcp.compute.networkgcp.compute.network
Example
Find GCP instances with this network
gcp.compute.network: 000D3A36DDED
gcp.compute.privateIpAddressgcp.compute.privateIpAddress
Examples
Find GCP instances with this private IP
gcp.compute.privateIpAddress: 10.240.0.7
Find GCP instances with this private IP range
gcp.compute.privateIpAddress: [10.240.0.7 ...
10.240.0.30]
gcp.compute.projectIdgcp.compute.projectId
Examples
Find GCP instances related to ID
gcp.compute.projectId: qvsa-dev
Find GCP instances that match exact value
gcp.compute.projectId: `qvsa-dev`
gcp.compute.projectNumbergcp.compute.projectNumber
Examples
Find GCP instances related to this number
gcp.compute.projectNumber: 1035365309337
Find GCP instances that match exact value
gcp.compute.projectNumber: `1035365309337`
gcp.compute.publicIpAddressgcp.compute.publicIpAddress
Examples
Find GCP instances with this public IP
gcp.compute.publicIpAddress: 104.196.57.216
Find GCP instances within this IP range
gcp.compute.publicIpAddress: [104.196.57.216 ...
104.196.57.218]
gcp.compute.stategcp.compute.state
Type your drop-dowSelect the name of the instance state (PENDING, RUNNING, STOPPED, TERMINATED, STOPPING, SHUTTING_DOWN, DEALLOCATED) you're interested in. Select from names in the drop-down menu.
Example
Find running GCP instances
gcp.compute.state: RUNNING
gcp.compute.zonegcp.compute.zone
Examples
Find GCP instances related to name
gcp.compute.zone: us-east1-d
Find GCP instances that match exact value
gcp.compute.zone: `us-east1-d`
gcp.compute.hasAgentgcp.compute.hasAgent
Example
Find GCP instances with agents
gcp.compute.hasAgent: "true"
gcp.labels.namegcp.labels.name
Examples
Find VM instances with key "department"
gcp.labels:(name: department)
Find VM instances that match exact key value "department"
gcp.labels:(name: 'department')
Find VM instances with key starting "dep"
gcp.labels:(name: dep*)
gcp.labels.valuegcp.labels.value
Examples
Find VM instances with tag value "product-management"
gcp.labels:(value: product-management)
Find VM instances that match exact key value "product-management
"
gcp.labels:(value: 'product-management')
Find VM instances with tag value starting "product"
gcp.labels:(value: product*)
oci.compute.availabilityDomainoci.compute.availabilityDomain
Example
Show all assets with the available domain Lhkx:US-ASHBURN-AD-1
oci.compute.availabilityDomain:"Lhkx:US-ASHBURN-AD-1"
oci.compute.canonicalRegionNameoci.compute.canonicalRegionName
Example
Show all assets with the canonical region name us-ashburn-1
oci.compute.canonicalRegionName:"us-ashburn-1"
oci.compute.compartmentIdoci.compute.compartmentId
Example
Show assets with this OCI compartment ID
oci.compute.compartmentId:"ocid1.compartment.oc1..123452sjze35z6bkhvwjtzzgcp534zj4o75tgsizg3q36wl447jvfg6dq"
oci.compute.compartmentNameoci.compute.compartmentName
Example
Show assets with this OCI compartment name
oci.compute.compartmentName:"ocid1.compartment.abc"
oci.compute.displayNameoci.compute.displayName
Example
Show assets with display name oracle 8.
oci.compute.displayName:"oracle 8"
oci.compute.faultDomainoci.compute.faultDomain
Example
Show all assets with fault domain FAULT-DOMAIN-1
oci.compute.faultDomain:"FAULT-DOMAIN-1"
oci.compute.hasAgentoci.compute.hasAgent
Example
Show all assets with having cloud agent installed
oci.compute.hasAgent:"true"
oci.compute.hostNameoci.compute.hostName
Example
Show all findings with the host name oracle-8
oci.compute.hostName:"oracle-8"
oci.compute.imageIdoci.compute.imageId
Example
Show all assets with the ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq image ID
oci.compute.imageId:"ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq"
oci.compute.ociIdoci.compute.ociId
Example
Show assets with this OCI ID
oci.compute.ociId:"ocid1.compartment.oc1..1234567lbhcx2ajiagh57wrurvqs2ubd4ttaimgy22cxh3r6brpmmugq"
oci.compute.regionoci.compute.region
Example
Show all assets with the region us-east-1
oci.compute.region:"us-east-1"
oci.compute.regionKeyoci.compute.regionKey
Example
Show all assets with the region key SYD
oci.compute.regionKey:"SYD"
oci.compute.regionRealmoci.compute.regionRealm
Example
Show all assets with the region realm OC1
oci.compute.regionRealm:"OC1"
oci.compute.shapeoci.compute.shape
Example
Show all assets with the shape x5-2.36.512
oci.compute.shape:"x5-2.36.512"
oci.compute.stateoci.compute.state
Example
Show all assets with the compute state Starting
oci.compute.state:STARTING
oci.compute.tenantIdoci.compute.tenantId
Example
Show all assets with the specific tenant ID
oci.compute.tenantId:"ocid1.tenancy.oc1..aaaaaaaax2gwhq3hszjqhte5pgzijgyge6gvlsrqar6kxn7itwhk7keokamq"
oci.compute.tenantNameoci.compute.tenantName
Example
Show all assets with the specific tenant name
oci.compute.tenantName:"oraclecengg1"
oci.vnic.macAddroci.vnic.macAddr
Example
Show all assets with the MAC address 02:00:17:06:bd:b3
oci.vnic(macAddr:"02:00:17:06:bd:b3")
oci.vnic.nicIndexoci.vnic.nicIndex
Example
Show all assets with the index 1
oci.vnic(nicIndex:1)
oci.vnic.privateIpoci.vnic.privateIp
Example
Show all assets with this private IP
oci.vnic(privateIp:10.0.0.222)
oci.vnic.publicIpoci.vnic.publicIp
Example
Show all assets with this public IP
oci.vnic(publicIp:10.0.0.222)
oci.vnic.subnetCidrBlockoci.vnic.subnetCidrBlock
Example
Show all assets with the block 10.0.0.0/24
oci.vnic(subnetCidrBlock:10.0.0.0/24)
oci.vnic.subnetIdoci.vnic.subnetId
Example
Find OCI instances with this subnet ID
oci.vnic(subnetId: "subnet-bc02c0d4")
oci.vnic.subnetNameoci.vnic.subnetName
Example
Find OCI instances with this subnet name
oci.vnic(subnetName: "subnet-abc")
Example
Show all assets with this VCN ID
oci.vnic(vcnId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
oci.vnic.vcnNameoci.vnic.vcnName
Example
Show all assets with this vcn name
oci.vnic(vcnName:"abc")
oci.vnic.virtualRouterIpoci.vnic.virtualRouterIp
Example
Show all assets with the router IP 10.0.0.1
oci.vnic(virtualRouterIp:10.0.0.1)
oci.vnic.vlanTagoci.vnic.vlanTag
Example
Show all assets with the vlan tag 1
oci.vnic(vlanTag:1)
oci.vnic.vnicIdoci.vnic.vnicId
Example
Show all assets with the VNIC ID ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q
oci.vnic(vnicId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")
ibm.virtualServer.datacenterIdibm.virtualServer.datacenterId
Example
Find IBM instances with this datacenter ID
ibm.virtualServer.datacenterId: 1854895
ibm.virtualServer.deviceNameibm.virtualServer.deviceName
Examples
Find IBM instances related to name
ibm.virtualServer.deviceName: "virtualserver01.Qualys-Inc.cloud"
Find IBM instances that match exact value
ibm.virtualServer.deviceName: `virtualserver01.Qualys-Inc.cloud`
ibm.virtualServer.domainibm.virtualServer.domain
Example
Show all assets with virtual server domain Qualys-Inc.cloud
ibm.virtualServer.domain:"Qualys-Inc.cloud"
ibm.virtualServer.idibm.virtualServer.id
Example
Show all assets with the 8998892 virtual server ID
ibm.virtualServer.id:8998892
ibm.virtualServer.locationibm.virtualServer.location
Example
Find IBM instances in this location
ibm.virtualServer.location: westus
ibm.virtualServer.privateIpAddressibm.virtualServer.privateIpAddress
Examples
Find IBM instances with this private IP
ibm.virtualServer.privateIpAddress: 10.240.0.7
Find IBM instances with this private IP range
ibm.virtualServer.privateIpAddress: [10.240.0.7
... 10.240.0.30]
ibm.virtualServer.privateVlanibm.virtualServer.privateVlan
Example
Find the IBM instance with this private Vlan address
ibm.virtualServer.privateVlan: 3455
ibm.virtualServer.publicIpAddressibm.virtualServer.publicIpAddress
Examples
Find IBM instances with this public IP
ibm.virtualServer.publicIpAddress: 10.240.0.7
Find IBM instances with this public IP range
ibm.virtualServer.publicIpAddress: [10.240.0.7
... 10.240.0.30]
ibm.virtualServer.publicVlanibm.virtualServer.publicVlan
Example
Find the IBM instance with this public Vlan address
ibm.virtualServer.publicVlan: 3455
software:(lifecycle.detectionScoresoftware:(lifecycle.detectionScore
Examples
Show the software product with the lifecycle detection score
software:(lifecycle.detectionScore: 80)
Show the software product with the lifecycle detection score
software:(lifecycle.detectionScore>80)
Show the software product with the lifecycle detection score
software:(lifecycle.detectionScore<80)
Show the software product with the lifecycle detection score
software:(lifecycle.detectionScore<=80)
Show the software product with the lifecycle detection score
software:(lifecycle.detectionScore>=80)
openPorts:(detectionScoreopenPorts:(detectionScore
Examples
Show open ports based on the following QDS score
openPorts:(detectionScore: 80)
Show open ports based on the following QDS score
openPorts:(detectionScore>80)
Show open ports based on the following QDS score
openPorts:(detectionScore<80)
Show open ports based on the following QDS score
openPorts:(detectionScore>=80)
missingSoftware.detectionScoremissingSoftware.detectionScore
Examples
Show findings with the the missing software detection score
missingSoftware.detectionScore: 50)
Show findings with the missing software detection score
missingSoftware.detectionScore>50)
Show findings with the missing software detection score
missingSoftware.detectionScore<50)
Show findings with the missing software detection score
missingSoftware.detectionScore>=50)
Show findings with the missing software detection score
missingSoftware.detectionScore<=50)
software:(discoverySourcessoftware:(discoverySources
Examples
Show findings from cloud agents
software:(discoverySources: Cloud Agent)
Show findings from Passive Sensor
software:(discoverySources: CMDB)
openPorts:(discoverySourcesopenPorts:(discoverySources
Examples
Show findings from cloud agents
openPorts:(discoverySources: Cloud Agent)
Show findings from Passive Sensor
openPorts:(discoverySources: CMDB)
Use these tokens when searching Alibaba assets.
alibaba.instance.accountIdalibaba.instance.accountId
Examples
Find Alibaba instances with the following account ID
alibaba.instance.accountId: 123456789012
Find Alibaba instances with account ID starting "12345"
alibaba.instance.accountId: 12345*
alibaba.instance.dnsServeralibaba.instance.dnsServer
Example
Find Alibaba instances of the following DNS
alibaba.instance.dnsServer: 100.xxx.x.xxx
alibaba.instance.hasAgentalibaba.instance.hasAgent
Example
Find Alibaba instances with agents
alibaba.instance.hasAgent: true
alibaba.instance.hostNamealibaba.instance.hostName
Example
Find Alibaba instances related to name
alibaba.instance.hostName: abc.qualys.com
alibaba.instance.imageIdalibaba.instance.imageId
Example
Find instances related to image id
alibaba.instance.imageId: ubuntu_14_0405_64_20G_alibase_20170824.vhd
alibaba.instance.instanceIdalibaba.instance.instanceId
Example
Find Alibaba instances with this instance ID
alibaba.instance.instanceId: i-a2dxxxxsxxxxxhdfax
alibaba.instance.instanceTypealibaba.instance.instanceType
Example
Find Alibaba instances with this instance type
alibaba.instance.instanceType: ecs.t5-lc1m1.small
alibaba.instance.interfaceIdalibaba.instance.interfaceId
Example
Find Alibaba instances of the following interface id
alibaba.instance.interfaceId: a2dxxxxaixxxtux572
alibaba.instance.instanceStatealibaba.instance.instanceState
Example
Find Alibaba instances for the following state
alibaba.instance.instanceState: RUNNING
alibaba.instance.macAddressalibaba.instance.macAddress
Example
Find Alibaba instances with this MAC address
alibaba.instance.macAddress: 00:16:3e:0f:XX:XX
alibaba.instance.networkTypealibaba.instance.networkType
Example
Find Alibaba instances with this network type
alibaba.instance.networkType: vpc
alibaba.instance.privateIpAddressalibaba.instance.privateIpAddress
Example
Find Alibaba instances with the following private IP address
alibaba.instance.privateIpAddress: 192.168.XX.XX
alibaba.instance.publicIpAddressalibaba.instance.publicIpAddress
Example
Find Alibaba instances with the following public IP address
alibaba.instance.publicIpAddress: 149.xx.xx.xx
alibaba.instance.region.codealibaba.instance.region.code
Example
Find Alibaba instances for the following region code
alibaba.instance.region.code: cn-chengdu
alibaba.instance.region.namealibaba.instance.region.name
Example
Find Alibaba instances for the following region
alibaba.instance.region.name: US (Silicon Valley)
alibaba.instance.serialNumberalibaba.instance.serialNumber
Example
Find Alibaba instances of the following serial number
alibaba.instance.serialNumber: 12trexxxxr-3xx-xxx-rtg4-xxxx6t45
alibaba.instance.vpcCidrBlockalibaba.instance.vpcCidrBlock
Use a text value to define the serial number of the instance.
Example
Find Alibaba instances of the following CIDR block
alibaba.instance.vpcCidrBlock: 172.xx.x.x/16
alibaba.instance.vpcIdalibaba.instance.vpcId
Use a text value to search all the Alibaba instances with the specified VPC ID.
Example
Show Alibaba instances with this VPC ID
alibaba.instance.vpcId: vpc-a2d6pxxxxvvdadd5yikj
alibaba.instance.vswitchIdalibaba.instance.vswitchId
Use a text value to search all the Alibaba instances with the specified vswitchId.
Example
Show Alibaba instances with of the following switch ID
alibaba.instance.vswitchId: vsw-a2dxxxoxxxxsqx1mxxxdd
alibaba.instance.vswitchCidrBlockalibaba.instance.vswitchCidrBlock
Use an integer value to define the CIDR block of the switch to which the Alibaba instance is connected.
Example
Find Alibaba instances of the following CIDR block of the switch
alibaba.instance.vswitchCidrBlock: 192.168.XX.XX/24
alibaba.instance.zoneIdalibaba.instance.zoneId
Examples
Find Alibaba instances of the following zone id
alibaba.instance.zoneId: cn-chengdu-a
The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.
Example
Show assets with operating system Windows and Linux
operatingSystem: windows and operatingSystem:
linux
Narrow down your search by using the 'not' operator in your Boolean query. The result contains all the other values except the one that you specify after 'not' in your query.
Example
not tags.name: Windows
Assets with the Windows tag are excluded from search results.
Example
Show assets with one of these tag names
tag.name: Cloud Agent or tag.name: HQ