Search Tokens for Tag Rules
Click to view navigation pane


Search Tokens for Tag Rules

Use these tokens in the tag creation wizard (Dynamic tag > Asset Inventory rule).

Note:

- For all the date-related tokens, the date search is evaluated only for UTC format. The actual search results might show you the date as per your time zone.

- For the range searches, remember that the QQL search tokens are case-sensitive. Hence, make sure that you enter the correct token syntax. For more information, see Range Searches.

- The <, >, <=, >=, == operators are supported only for QQL tokens with the numeric data type. Note that they are not supported for QQL tokens with string data types. 

 

accounts.usernameaccounts.username

Use a text value ##### to help you find an account username you're looking for.

Example

Show findings with username administrator

accounts.username:administrator

asset.biosDescriptionasset.biosDescription

Use values within quotes or backticks to help you find the BIOS description you're looking for.

Examples

Show any findings that contain parts of description

asset.biosDescription:"American Megatrends Inc."

Show any findings that match exact value "American Megatrends Inc."

asset.biosDescription:`American Megatrends Inc.`

asset.nameasset.name

Use values within quotes or backticks to help you find the asset name you're looking for.

Examples

Show any findings that match the beginning of any substrings within the asset name

asset.name:"ACMENVT7"

Show any findings that match exact value "ACMENVT7"

asset.name:`ACMENVT7`

asset.domainRoleasset.domainRole

Use values within quotes or backticks to help you find the assets with certain domain role (Standalone Workstation, Member Workstation, Standalone Server, Member Server, Backup Domain Controller, and Primary Domain Controller). Select from values in the drop-down menu.

Examples

Show any findings that contain parts of name

asset.domainRole:"Member Ser"

Show any findings that match exact value "Member Server"

asset.domainRole:`Member Server`

asset.lastLocation.continentasset.lastLocation.continent

Use a text value ##### to help you find assets based on continent of the last location.

Example

Show assets with last location continent as North America

asset.lastLocation.continent: North America

asset.lastLocation.countryasset.lastLocation.country

Use a text value ##### to help you find assets based on country of the last location.

Example

Show assets with last location country as United States

asset.lastLocation.country: United States

asset.lastLocation.cityasset.lastLocation.city

Use a text value ##### to help you find assets based on city of the last location.

Example

Show assets with last location city as Redwood City

asset.lastLocation.city: Redwood City

asset.lastLocation.postalasset.lastLocation.postal

Use an integer value ##### to help you find the assets based on postal of the last location.

Example

Show assets with last location postal as 94065

asset.lastLocation.postal: 94065

asset.lastLoggedOnUserasset.lastLoggedOnUser

Use a text value ##### to help you find assets last logged into by a user of interest.

Examples

Show assets with last logon by user asmith

asset.lastLoggedOnUser:asmith

asset.lastLocation.stateasset.lastLocation.state

Use a text value ##### to help you find assets based on state of the last location.

Example

Show assets with last location state as California

asset.lastLocation.state: California

asset.netbiosNameasset.netbiosName

Use a text value ##### to define the asset NetBIOS name you're interested in.

Examples

Show the asset with this name

asset.netbiosName:ACMENVT7

asset.trackingMethodasset.trackingMethod

Find assets with certain tracking method (ACTIVE_DIRECTORY, BMC_HELIX, DNSNAME, EASM, GCP_INSTANCE_ID, ICS_OCA, INSTANCE_ID, IP, NETBIOS, NONE, OCA, ORACLE, PASSIVE_SENSOR, QAGENT, SEM, SERVICE_NOW, THIRD_PARTY, VIRTUAL_MACHINE_ID, and WEBHOOK). Select from values in the drop-down menu.

Example

Find assets with this tracking method

asset.trackingMethod: QAGENT

asset.riskScoreasset.riskScore

Use a numerical value ##### to search all the assets with their severity based on the calculated risk score between 0 to 1000. Note that the <, >, <=, >=, == operators are supported for this QQL token.

Note:  

- This QQL token is now deprecated and may be visible to limited users during the withdrawal phase.

- You can't create tags using this token in combination with other QQL tokens. Refer to the following example:

asset.riskScore >500 and operatingSystem:"Windows"

Examples

Show all the assets with a risk score 900

asset.riskScore:900

Show all the assets with risk score between the range 800 to 1000

asset.riskScore:[800 ... 1000]

Show all the assets with a risk score greater than 500

asset.riskScore >500

Show all the assets with a risk score less than or equal to 800

asset.riskScore <=800

asset.domainasset.domain

Use values within quotes or backticks to help you find the assets with their domain.

Examples

Show assets that match the exact value of the domain

asset.domain: `qualys.com`

Show assets that contain parts of the domain

asset.domain: "qualys."

asset.subdomainasset.subdomain

Use values within quotes or backticks to help you find assets using their subdomains.

Examples

Show assets that match the exact value of the subdomains

asset.subdomain: `doc.qualys.com`

Show assets that contain the parts of the subdomains

asset.subdomain: "doc.qualys."

asset.fqdnasset.fqdn

Use a text value ##### to define the asset FQDN name you're looking for.

Example

Show the asset with this FQDN

asset.fqdn:ACMENVT7.acme.com

easm.tags.nameeasm.tags.name

Provide the value to filter assets based on tags discovered
through EASM.

Example

Find assets with "cloud" tag

easm.tags.name: cloud

asset.hostingCategory1asset.hostingCategory1

Use a value to filter your assets based on the hosting category. The supported values are CDN, Cloud, OnPrem, and ThirdParty.

Example

Show findings with hosting catagory CDN

asset.hostingCategory1:"CDN"

asset.org.nameasset.org.name

Use values within quotes or backticks to help you find the assets with the organization name you're looking for.

Examples

Show assets details that match the exact value of the organization name

asset.org.name: `Qualys, Inc.`

Show assets details that contain parts of the organization name

asset.org.name: "Qualys,"

asset.ispasset.isp

Use values within quotes or backticks to help you find the assets with the Internet Service Provider (ISP) name you're looking for.

Examples

Show assets that match the exact ISP name

asset.isp: `amazon.com, Inc.`

Show assets that are with the parts of the ISP name

asset.isp: "amazon.com,"

asset.asnasset.asn

Use values within quotes or backticks to help you find the assets with the ASN value you're looking for.

Examples

Show assets that match the exact value of ASN

asset.asn: `AS8075`

Show assets that are with the parts of the ASN

asset.asn: "AS807"

customAttributes.connectorIdcustomAttributes.connectorId

Provide the value to identify your assets based on the connector Id. Enter the connector Id as 0, which is the default connector Id for connector 'Qualys'.

Example

Find assets for connector 'Qualys'

customAttributes:(connectorId:0)

customAttributes.keycustomAttributes.key

Provide the value to identify your assets based on the key entered as part of the custom attribute.

Example

Find assets with "Department" as part of the key name

customAttributes:(key:"Department")

The result includes assets with the 'Department' custom attribute key.

Note: If 'Department' is part of the key name, such as Department 1, Department A-C, or Department US, those assets are also included in the result.

customAttributes.valuecustomAttributes.value

Provide the value to identify your assets based on the value entered as part of the custom attribute.

Example

Find assets with "DEVOPS" as part of the key value

customAttributes:(value:"DEVOPS")

The result includes assets with the 'DEVOPS' custom attribute value.

Note: If 'DEVOPS' is part of the value name, such as DEVOPS CSAM, DEVOPS CA, or DEVOPS PM, those assets are also included in the result.

whoIs.registrantEmailIdwhoIs.registrantEmailId

Use values within quotes or backticks to find all the assets using the registrant email id of domain or subdomain.

Examples

Show all the assets for which the exact registrant email id of the domain or subdomain matches

whoIs:(registrantEmailId: `66aab8e6ace-49101@contact.qualys.net`)

Show all the assets for which the part of the registrant email id of the domain or subdomain matches

whoIs:(registrantEmailId: "66aab8e6ace-49101@contact.qualys.net")

whoIs.registrantOrgwhoIs.registrantOrg

Use values within quotes or backticks to find all the assets using the registrant organization of domain or subdomain.

Examples

Show all the assets for which the exact registrant organization of domain/subdomain matches

whoIs:(registrantOrg: `Qualys, Inc`)

Show all the assets for which the part of the registrant organization of domain/subdomain matches

whoIs:(registrantOrg: "Qualys,")

whoIs.registrarwhoIs.registrar

Use values within quotes or backticks to find all the assets using the registrar.

Examples

Show all the assets for which the exact registrar matches

whoIs:(registrar: `abc net`)

Show all assets for which the part of the registrar matches

whoIs:(registrar: "abc net")

hardwarehardware

Use values within quotes or backticks to help you find the hardware name you're looking for.

Examples

Show any findings that contain parts of name

hardware:"Dell Latitude e7470"

Show any findings that match exact value

hardware:`Dell Latitude e7470`

hardware.categoryhardware.category

Use values within quotes or backticks to help you find the hardware category you're looking for.

Examples

Show any findings that match exact value

hardware.category:Printers/Laser

hardware.category1hardware.category1

Use text value ##### to find assets with hardware category 1 value. 

Example

If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.

Show any findings that match exact value

hardware.category1:Printers

hardware.category2hardware.category2

Use text value ##### to find assets with hardware category 2 value.

Example

If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.

Show any findings that match exact value

hardware.category2:Laser

hardware.manufacturerhardware.manufacturer

Use quotes or backticks within values to find assets having a certain hardware manufacturer.

Example

Show any findings that match exact value "Dell"

hardware.manufacturer:`Dell`

hardware.modelhardware.model

Use quotes or backticks within values to find assets having a certain hardware model.

Example

Show any findings that match exact value "e7470"

hardware.model:`De7470`

hardware.producthardware.product

Use quotes or backticks within values to find assets having a certain hardware product.

Example

Show any findings that match exact value "Latitude"

hardware.product:`Latitude`

hardware.lifecycle.stagehardware.lifecycle.stage

Use a text value ##### in quotes to define the hardware lifecycle stage (INTRO, GA, EOS, OBS)

Example

Show End-of-Sale hardware

hardware.lifecycle.stage:"EOS"

inventory:(sourceinventory:(source

Use a text value ##### to help you find assets from a certain Qualys source. (API, Active Directory, Appliance, Azure, BMC Helix, CAPS, CMDB, Cloud Agent, EASM, EC2, GCP, ICS OCA, IP Scanner, Malware Domain, Mobility Scanner, OCA, OCI, Passive Sensor, ServiceNow, VMWare vSphere, and Webhook) Select from values in the drop-down menu.

Examples

Show findings from cloud agents

inventory:(source: Cloud Agent)

Show findings from Passive Sensor

inventory:(source: Passive Sensor)

interfaces:(addressinterfaces:(address

Use values to define an IP address you're interested in.

Examples

Show the exact match of the IP address

interfaces:(address:`10.10.100.20`)

Show any findings that contain parts of the IP address

interfaces:(address:"10.10.100.2")
interfaces:(address: 10.10.100.2)

interfaces:(hostnameinterfaces:(hostname

Use values within quotes or backticks to help you find the hostname you're looking for.

Examples

Show any findings related to name

interfaces:(hostname: xpsp2-jp-26-111)

Show any findings that contain parts of name

interfaces:(hostname: "xpsp2-jp-26-111")

Show any findings that match exact value "xpsp2-jp-26-111"

interfaces:(hostname: `xpsp2-jp-26-111`)

Show any findings related to name (we'll match super domains)

interfaces:(hostname: qcentos71sqp3.rdlab.acme.com)

Show any findings that match exact value "qcentos71sqp3.rdlab.acme.com"

interfaces:(hostname: `qcentos71sqp3.rdlab.acme.com`)

Show findings according to values entered in the square brackets.

Note: You can add multiple values in []. However, it's important to understand that partial values are not supported. You must enter the exact match value.

Example with correct syntax - interfaces:(hostname: [win7-181, bridge.vuln.qa.qualys.com])

Example with incorrect syntax - interfaces:(hostname: [win7, bridge.vuln.qa])

interfaces:(gatewayAddressinterfaces:(gatewayAddress

Use a text value ##### to help you find assets with a certain default gateway address.

Example

Show assets with this default gateway address

interfaces:(gatewayAddress:10.11.65.1)

interfaces:(interfaceNameinterfaces:(interfaceName

Use a text value ##### to help you find a certain interface name.

Example

Show the asset with name PRO/1000

interfaces:(interfaceName:PRO/1000)

software:(isPackagesoftware:(isPackage

Use the values true | false to define whether software is a package.

Example

Show software that is a package

software:(isPackage:"true")

software:(isPackageComponentsoftware:(isPackageComponent

Use the values true | false to define whether software is a package component.

Example

Show software that is a package component

software:(isPackageComponent:"true")

openPorts.detectedServiceopenPorts.detectedService

Use values within quotes or backticks to help you find the detected service you're looking for.

Examples

Show any findings with this service name

openPorts:(detectedService: win_remote_desktop)

Show any findings that contain parts of name

openPorts:(detectedService: "win_remote_desktop")

Show any findings that match exact value "win_remote_desktop"

openPorts:(detectedService: `win_remote_desktop`)

openPorts.portopenPorts.port

Use an integer value ##### to help you find assets with some open port.

Example

Show assets with open port 80

openPorts:(port:80)

operatingSystemoperatingSystem

Use values within quotes or backticks to help you find the full operating system name you're looking for.

Examples

Show any findings that contain components of OS name

operatingSystem:"Windows 7 SP2 Enterprise"

Show any findings that match exact value

operatingSystem:`Windows 7 SP2 Enterprise`

operatingSystem.categoryoperatingSystem.category

Use text value ##### to help you find the full operating system category name you're looking for, i.e. Windows, Unix, Linux, Mac and more.

Example

Show any findings that match exact value

operatingSystem.category:Windows/Embedded

operatingSystem.category1operatingSystem.category1

Use text value ##### to help you find the operating system category 1 value you're looking for.

Example

If you are searching for assets with Windows Embedded operating  system, then category1 is Windows and category2 is Embedded.

Show any findings that match exact value

operatingSystem.category1:Windows

operatingSystem.category2operatingSystem.category2

Use quotes or backticks to help you find the operating system category 1 value you're looking for.

Example

If you are searching for assets with Windows Embedded operating  system, then category1 is Windows and category2 is Embedded.

Show any findings that match exact value

operatingSystem.category2:Embedded

operatingSystem.publisheroperatingSystem.publisher

Use a text value ##### to define an operating system manufacturer you're looking for.

Example

Show findings with this exact software publisher

operatingSystem.publisher:Microsoft

operatingSystem.nameoperatingSystem.name

Use text value ##### to help you find the operating system brand name you're looking for, e.g. Windows OS.

Example

Show any findings that match exact value

operatingSystem.name:Windows 10

operatingSystem.architectureoperatingSystem.architecture

Use text value ##### to help you find the operating system architecture you're looking for, i.e. 32-Bit or 64-Bit.

Example

Show any findings that match exact value

operatingSystem.architecture:64-Bit

operatingSystem.marketVersionoperatingSystem.marketVersion

Use text value ##### to help you find the operating system market version, e.g. Windows OS.

Example

Show any findings that match exact value

operatingSystem.marketVersion:7

operatingSystem.versionoperatingSystem.version

Use a text value ##### to define the OS version you're interested in.

Example

Show findings with this exact OS version

operatingSystem.version:16.1

operatingSystem.updateoperatingSystem.update

Use a text value ##### to define an OS update version of interest.

Example

Show findings with this exact OS update version

operatingSystem.update:SP2

operatingSystem.editionoperatingSystem.edition

Use text value ##### to help you find the operating system edition you're looking for.

Example

Show any findings that match exact value

operatingSystem.edition:Enterprise

operatingSystem.lifecycle.stageoperatingSystem.lifecycle.stage

Use a text value ##### to define an OS lifecycle stage you're looking for, i.e. active, eol, obsolete.

Examples

Show findings having this OS lifecycle stage

operatingSystem.lifecycle.stage:eol

Show findings with OS category Windows and OS lifecycle stage "active"

operatingSystem:(category:Windows AND lifecycle.stage:eol)

passiveSensor.idpassiveSensor.id

Use an integer value ##### to help you find assets sensed by a certain sensor ID.

Example

Show this sensor ID

passiveSensor.id:"003687557369:1654660042:3809075:704:1654660042:3809075:704"

passiveSensor.locationpassiveSensor.location

Use a text value ##### to help you find assets based on specific sensor location.

Examples

Show assets with sensor location (appliance location label) as SanJose1

passiveSensor.location:"SanJose1"

passiveSensor.namepassiveSensor.name

Use a text value ##### to help you find assets based on specific sensor name.

Examples

Show assets with sensor name as ITCorp-appliance

passiveSensor.name:"ITCorp-appliance"

software:(lifecycle.stagesoftware:(lifecycle.stage

Use a text value ##### to define a software lifecycle stage you're looking for, i.e. active, eol, obsolete.

Examples

Show findings having this software lifecycle stage

software:(lifecycle.stage:eol)

Show findings having software category Windows and software lifecycle stage "active"

software:(category:Windows AND lifecycle.stage:eol)

services.nameservices.name

Use text value ##### within values to help you find assets with a service name you're looking for.

Example

Show any findings that match exact value

services:(name:CertPropSvc)

services.statusservices.status

Use text value ##### within values to help you find the service status you're looking for.

Example

Show any findings that match exact value

services:(status:RUNNING)

software:(license.categorysoftware:(license.category

Use text value ##### to help you find a software license category, i.e. Open Source, Commercial.

Example

Show any findings that match exact value

software:(license.category:`Open Source`)

software:(architecturesoftware:(architecture

Use text value ##### to help you find the software architecture you're looking for, i.e 32-Bit or 64-Bit.

Example

Show any findings that match exact value

software:(architecture:64-Bit)

software:(editionsoftware:(edition

Use text value ##### to help you find the software edition you're looking for.

Example

Show any findings that match exact value

software:(edition:Professional)

software:(categorysoftware:(category

Use quotes or backticks within values to help you find a software category.

Example

Show any findings that match exact value

software:(category: Application Development/Testing)

software:(category1software:(category1

Use text value ##### to help you find the software category 1 value you're looking for.

Example

If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.

Show any findings that match exact value

software:(category1:Application Development)

software:(category2software:(category2

Use text value ##### to help you find the software category 2 value you're looking for.

Example

If you are searching for assets having testing software, then category1 is Application Development and category2 is Testing.

Show any findings that match exact value

software:(category2:Testing)

software:(marketVersionsoftware:(marketVersion

Use text value ##### to help you find a software market version, e.g. Windows OS.

Example

Show any findings that match exact value

software:(marketVersion:7)

software:(namesoftware:(name

Use values within quotes or backticks to help you find the software name you're looking for. Quotes can be used when the value has more than one word.

Examples

Show any findings with this name

software:(name:VMware Tools)

Show any findings that contain parts of name

software:(name:"VMware Tools")

Show any findings that match exact value

software:(name:`VMware Tools`)

Find assets with certain tag and software installed

tags.name: `Cloud Agent` AND software: (name: `Cisco AnyConnect Secure Mobility Client` AND version: `3.1.12345`)

software:(productsoftware:(product

Use a text value ##### to define a software product name you're looking for.

Example

Show findings with this exact product name

software:(product:Office)

software:(publishersoftware:(publisher

Use a text value ##### to define a software manufacturer you're looking for.

Example

Show findings with this exact software publisher

software:(publisher:Microsoft)

software:(updatesoftware:(update

Use a text value ##### to define a software update version of interest. Note that the <, >, <=, >=, == operators are not supported for this QQL token.

Example

Show findings with this exact software update version

software:(update:16.0.1.2)

Show findings with software update version within this version range

software:(update:[16.0.1.2 ... 16.0.1.5])

software:(versionsoftware:(version

Use a text value ##### to define the software version you're interested in. Note that the <, >, <=, >=, == operators are not supported for this QQL token.

Example

Show findings with this exact software version

software:(version:16.0)

Show findings with software version within this version range

software:(version:[16.0 ... 20.0])

software:(componentsoftware:(component

Use a value Client, Server or " " (empty field) to identify the software component.

Example

Show findings with Client software component

software:(component:Client)

providerprovider

Find assets synced from a certain cloud provider (AWS, AZURE, GCP). Select from names in the drop-down menu.

Examples

Show assets synced from Amazon AWS

provider: "AWS"

aws.ec2.accountIdaws.ec2.accountId

Use a text value ##### to find EC2 instances with a certain account ID.

Examples

Find EC2 instances that match this account ID

aws.ec2.accountId: 123456789012

Find EC2 instances with account ID starting "12345"

aws.ec2.accountId: 12345*

Find EC2 instances where account ID is null (remove the colon)

aws.ec2.accountId is null

aws.ec2.availabilityZoneaws.ec2.availabilityZone

Use a text value ##### to find EC2 instances by the availability zone in which the instance launched.

Example

Find EC2 instances in the us-east-1a availability zone

aws.ec2.availabilityZone: us-east-1a

aws.ec2.hasAgentaws.ec2.hasAgent

Use the values true | false to define whether the EC2 asset has a cloud agent.

Examples

Show findings with a cloud agent

aws.ec2.hasAgent: true

Show findings without a cloud agent

aws.ec2.hasAgent: false

aws.ec2.hostnameaws.ec2.hostname

Use a text value ##### to find the EC2 hostname you're looking for.

Examples

Find instances related to name

aws.ec2.hostname: abc.qualys.com

Find instances that match exact value

aws.ec2.hostname: `abc.qualys.com`

aws.ec2.imageIdaws.ec2.imageId

Use a text value ##### to find EC2 instances with a certain Image (AMI) ID.

Examples

Find instances related to the Image ID

aws.ec2.imageId: ami-2ea83347

Find instances that match exact value

aws.ec2.imageId: `ami-2ea83347`

aws.ec2.instanceIdaws.ec2.instanceId

Use a text value ##### to find EC2 instances by the instance ID.

Example

Find EC2 instances with this ID

aws.ec2.instanceId: i-1234567890abcdef0

aws.ec2.instanceStateaws.ec2.instanceState

Select the name of the instance state (PENDING, RUNNING, TERMINATED, STOPPED, STOPPING, SHUTTING-DOWN) you're interested in. Select from names in the drop-down menu.

Example

Find running EC2 instances

aws.ec2.instanceState: RUNNING

aws.ec2.instanceTypeaws.ec2.instanceType

Select the type of instance you're interested in. Select from names in the drop-down menu.

Example

Find EC2 instances with instance type t2.micro

aws.ec2.instanceType: t2.micro

aws.ec2.launchDateaws.ec2.launchDate

Use a date range or specific date to define when the EC2 instance launched. Enter dates in yyyy-mm-dd format.

Examples

Find EC2 instances launched within certain dates

aws.ec2.launchDate: [2017-06-15 ... 2017-06-30]

Find EC2 instances launched on specific date

aws.ec2.launchDate:'2017-08-15'

aws.ec2.privateDNSaws.ec2.privateDNS

Use a text value ##### to define a private DNS address you're interested in.

Example

Find the EC2 instance with this private DNS address

aws.ec2.privateDNS: ip-10-90-2-85.ec2.internal

aws.ec2.privateIpAddressaws.ec2.privateIpAddress

Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.

Examples

Find EC2 instances with this private IP address

aws.ec2.privateIpAddress: 10.90.0.119

Find EC2 instances within this IP range

aws.ec2.privateIpAddress: [10.1.78.23 ... 10.100.78.235]

aws.ec2.publicDNSaws.ec2.publicDNS

Use a text value ##### to define a public DNS address you're interested in.

Example

Find the EC2 instance with this public DNS address

aws.ec2.publicDNS: ec2-52-70-141-154.compute-1.amazonaws.com

aws.ec2.publicIpAddressaws.ec2.publicIpAddress

Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.

Examples

Find EC2 instances with this public IP address

aws.ec2.publicIpAddress: 52.70.141.154

Find EC2 instances within this IP range

aws.ec2.publicIpAddress: [52.70.141.154 ... 52.70.141.164]

aws.ec2.region.codeaws.ec2.region.code

Select the code of the region you're interested in. Select from codes in the drop-down menu.

Example

Find EC2 instances in the us-east-1 region

aws.ec2.region.code: us-east-1

aws.ec2.region.nameaws.ec2.region.name

Select the name of the region you're interested in. Select from names in the drop-down menu.

Example

Find EC2 instances in the US East (N. Virginia) region

aws.ec2.region.name: US East (N. Virginia)

aws.ec2.spotInstanceaws.ec2.spotInstance

Use the values true | false to define whether your EC2 instance is a Spot instance.

Examples

Show EC2 Spot instances

aws.ec2.spotInstance: "true"

Show EC2 instances that are not Spot instances

aws.ec2.spotInstance: "false"

aws.ec2.subnetIdaws.ec2.subnetId

Use a text value ##### to find EC2 instances by the ID of the subnet in which the interface resides.

Example

Find EC2 instances with this subnet ID

aws.ec2.subnetId: subnet-bc02c0d4

aws.ec2.vpcIdaws.ec2.vpcId

Use a text value ##### to find EC2 instances by the ID of the VPC in which the interface resides.

Example

Find EC2 instances with this VPC ID

aws.ec2.vpcId: vpc-1e37cd76

aws.tags.keyaws.tags.key

Use a text value ##### to find EC2 instances with a certain AWS tag key/name (case insensitive).

Examples

Find EC2 instances with key "devops"

aws.tags.key: devops

Find EC2 instances with key starting "dev"

aws.tags.key: dev*

Find EC2 instances with key ending "ops"

aws.tags.key: *ops

aws.tags.valueaws.tags.value

Use a text value ##### to find EC2 instances with a certain AWS tag value (case insensitive).

Examples

Find EC2 instances with tag value "dailybuild"

aws.tags.value: dailybuild

Find EC2 instances with tag value starting "daily"

aws.tags.value: daily*

Find EC2 instances with tag value ending "build"

aws.tags.value: *build

azure.tags.nameazure.tags.name

Use a text value ##### to find Azure instances with a certain tag name (case insensitive).

Examples

Find Azure instances with name "devops"

azure.tags.name: devops

Find Azure instances with name starting "dev"

azure:(tags.name: dev*

Find Azure instances with name ending "ops"

azure.tags.name: *ops

azure.tags.valueazure.tags.value

Use a text value ##### to find Azure instances with a certain tag value (case insensitive).

Examples

Find Azure instances with tag value "dailybuild"

azure.tags.value: dailybuild

Find Azure instances with tag value starting "daily"

azure.tags.value: daily*

Find Azure instances with tag value ending "build"

azure.tags.value: *build

azure.vm.imageOfferazure.vm.imageOffer

Use a text value ##### to define the image offer name (i.e. UbuntuServer or WindowsServer) for images deployed from the Azure image gallery.

Examples

Find Azure instances related to name

azure.vm.imageOffer: UbuntuServer

Find Azure instances that match exact value

azure.vm.imageOffer: `UbuntuServer`

azure.vm.imagePublisherazure.vm.imagePublisher

Use a text value ##### to define the name of the Azure virtual machine image publisher (i.e. Canonical or MicrosoftWindowsServer).

Examples

Find Azure instances related to name

azure.vm.imagePublisher: Canonical

Find Azure instances that match exact value

azure.vm.imagePublisher: `Canonical`

azure.vm.imageVersionazure.vm.imageVersion

Use a text value ##### to define the version of the Azure virtual machine image sku you're interested in.

Example

Find Azure instances with this sku version

azure.vm.imageVersion: 16.04.201708030

azure.vm.locationazure.vm.location

Use a text value ##### to define the region you're interested in.

Example

Find Azure instances in this location

azure.vm.location: westus

azure.vm.macAddressazure.vm.macAddress

Use a text value ##### to define the MAC address you're interested in.

Example

Find Azure instances with this MAC address

azure.vm.macAddress: '000D3A36DDED'

azure.vm.nameazure.vm.name

Use a text value ##### to find the Azure virtual machine name you're looking for.

Examples

Find Azure instances related to name

azure.vm.name: avset2

Find Azure instances that match exact value

azure.vm.name: `avset2`

azure.vm.platformazure.vm.platform

Use a text value ##### to define the operating system platform (Linux or Windows) of the Azure virtual machine.

Example

Find Azure instances on Windows platform

azure.vm.platform: Windows

azure.vm.privateIpAddressazure.vm.privateIpAddress

Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.

Examples

Find Azure instances with this private IP

azure.vm.privateIpAddress: 10.1.2.5

Find Azure instances within this IP range

azure.vm.privateIpAddress: [10.1.2.5 ... 10.1.2.33]

azure.vm.publicIpAddressazure.vm.publicIpAddress

Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.

Examples

Find Azure instances with this public IP

azure.vm.publicIpAddress: 13.126.125.189

Find Azure instances within this IP range

azure.vm.publicIpAddress: [13.126.125.180 ... 13.126.125.255]

azure.vm.resourceGroupNameazure.vm.resourceGroupName

Use a text value ##### to define the name of the resource group you're interested in.

Examples

Find Azure instances related to name

azure.vm.resourceGroupName: my-eastus-rg

Find Azure instances that match exact value

azure.vm.resourceGroupName: `my-eastus-rg`

azure.vm.sizeazure.vm.size

Use a text value ##### to help you find Azure VM instances with a certain virtual machine size.

Example

Find Azure instances with this size

azure.vm.size: Standard_D1

azure.vm.stateazure.vm.state

Select the name of the instance state (DEALLOCATED, DEALLOCATING, DELETED, RUNNING, STARTING, STOPPED, STOPPING) you're interested in. Select from names in the drop-down menu.

Example

Find running Azure instances

azure.vm.state: RUNNING

azure.vm.subnetazure.vm.subnet

Use a text value ##### to define the Azure virtual machine subnet you're interested in.

Example

Find Azure instances with this subnet

azure.vm.subnet: 10.1.2.0

azure.vm.subscriptionIdazure.vm.subscriptionId

Use a text value ##### to define the subscription ID of the Azure virtual machine subscription.

Example

Find Azure instances with this subscription ID

azure.vm.subscriptionId: fbb9ea64-abda-452e-adfa-83442409

azure.vm.virtualNetworkazure.vm.virtualNetwork

Use a text value ##### to define the operating system platform (Linux or Windows) of the Azure virtual machine.

Examples

Find Azure instances related to virtual network

azure.vm.virtualNetwork: cli-vnet

Find Azure instances that match exact value of virtual network

azure.vm.virtualNetwork: `cli-vnet`

azure.vm.vmIdazure.vm.vmId

Use a text value ##### to define the Azure virtual machine ID you're looking for.

Example

Find Azure instances with this ID

azure.vm.vmId: 13f56399-bd52-4150-9748-7190aae1ff21

azure.vm.hasAgentazure.vm.hasAgent

Use the values true | false to define whether the Azure virtual machine you're looking for has a cloud agent installed on it.

Example

Find Azure instances with agents

azure.vm.hasAgent: "true"

gcp.compute.hostnamegcp.compute.hostname

Use a text value ##### to define the hostname you're looking for.

Examples

Find GCP instances related to name

gcp.compute.hostname: instance-5.c.qvsa-dev.internal

Find GCP instances that match exact value

gcp.compute.hostname: `instance-5.c.qvsa-dev.internal`

gcp.compute.imageIdgcp.compute.imageId

Use a text value ##### to define the Google Compute image ID you're looking for.

Examples

Find GCP instances related to the Image ID

gcp.compute.imageId: projects/centos-cloud

Find GCP instances that match exact value

gcp.compute.imageId: `projects/centos-cloud/global/images/centos-6-v20191014`

gcp.compute.instanceIdgcp.compute.instanceId

Use a text value ##### to define the Google Compute instance ID you're looking for.

Example

Find GCP instances with this ID

gcp.compute.instanceId: 4392196237934605253

gcp.compute.macAddressgcp.compute.macAddress

Use a text value ##### to define the MAC address you're interested in.

Example

Find GCP instances with this MAC address

gcp.compute.macAddress: '000D3A36DDED'

gcp.compute.machineTypegcp.compute.machineType

Use a text value ##### to define the machine type of the virtual machine instance you're interested in.

Examples

Find GCP instances related to name

gcp.compute.machineType: n1-standard-1

Find GCP instances that match exact value

gcp.compute.machineType: `n1-standard-1`

gcp.compute.networkgcp.compute.network

Use a text value ##### to find GCP instances by the VPC network the instance belongs to.

Example

Find GCP instances with this network

gcp.compute.network: 000D3A36DDED

gcp.compute.privateIpAddressgcp.compute.privateIpAddress

Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.

Examples

Find GCP instances with this private IP

gcp.compute.privateIpAddress: 10.240.0.7

Find GCP instances with this private IP range

gcp.compute.privateIpAddress: [10.240.0.7 ... 10.240.0.30]

gcp.compute.projectIdgcp.compute.projectId

Use a text value ##### to define the project ID assigned to the GCP Console project the instance belongs to.

Examples

Find GCP instances related to ID

gcp.compute.projectId: qvsa-dev

Find GCP instances that match exact value

gcp.compute.projectId: `qvsa-dev`

gcp.compute.projectNumbergcp.compute.projectNumber

Use an integer value ##### to define the project number assigned to the GCP Console project the instance belongs to.

Examples

Find GCP instances related to this number

gcp.compute.projectNumber: 1035365309337

Find GCP instances that match exact value

gcp.compute.projectNumber: `1035365309337`

gcp.compute.publicIpAddressgcp.compute.publicIpAddress

Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.

Examples

Find GCP instances with this public IP

gcp.compute.publicIpAddress: 104.196.57.216

Find GCP instances within this IP range

gcp.compute.publicIpAddress: [104.196.57.216 ... 104.196.57.218]

gcp.compute.stategcp.compute.state

Type your drop-dowSelect the name of the instance state (PENDING, RUNNING, STOPPED, TERMINATED, STOPPING, SHUTTING_DOWN, DEALLOCATED) you're interested in. Select from names in the drop-down menu.

Example

Find running GCP instances

gcp.compute.state: RUNNING

gcp.compute.zonegcp.compute.zone

Use a text value ##### to define the zone of the GCP instance you're looking for

Examples

Find GCP instances related to name

gcp.compute.zone: us-east1-d

Find GCP instances that match exact value

gcp.compute.zone: `us-east1-d`

gcp.compute.hasAgentgcp.compute.hasAgent

Use the values true | false to define whether the GCP instances you're looking for has a cloud agent installed on it.

Example

Find GCP instances with agents

gcp.compute.hasAgent: "true"

gcp.labels.namegcp.labels.name

Use a text value ##### to find VM instances with a certain GCP labels name (case insensitive).

Examples

Find VM instances with key "department"

gcp.labels:(name: department)

Find VM instances that match exact key value "department"

gcp.labels:(name: 'department')

Find VM instances with key starting "dep"

gcp.labels:(name: dep*)

gcp.labels.valuegcp.labels.value

Use a text value ##### to find VM instances with a certain GCP labels value (case insensitive).

Examples

Find VM instances with tag value "product-management"

gcp.labels:(value: product-management)

Find VM instances that match exact key value "product-management"

gcp.labels:(value: 'product-management')

Find VM instances with tag value starting "product"

gcp.labels:(value: product*)

oci.compute.availabilityDomainoci.compute.availabilityDomain

Use a text value ##### to search all assets with the specified available domain.

Example

Show all assets with the available domain Lhkx:US-ASHBURN-AD-1

oci.compute.availabilityDomain:"Lhkx:US-ASHBURN-AD-1"

oci.compute.canonicalRegionNameoci.compute.canonicalRegionName

Use a text value ##### to search all assets having the specified canonical region name.

Example

Show all assets with the canonical region name us-ashburn-1

oci.compute.canonicalRegionName:"us-ashburn-1"

oci.compute.compartmentIdoci.compute.compartmentId

Use a text value ##### to search all assets with the specified OCI compartment ID.

Example

Show assets with this OCI compartment ID

oci.compute.compartmentId:"ocid1.compartment.oc1..123452sjze35z6bkhvwjtzzgcp534zj4o75tgsizg3q36wl447jvfg6dq"

oci.compute.compartmentNameoci.compute.compartmentName

Use a text value ##### to search all assets with the specified OCI compartment name.

Example

Show assets with this OCI compartment name

oci.compute.compartmentName:"ocid1.compartment.abc"

oci.compute.displayNameoci.compute.displayName

Use a text value ##### to search all assets with the specified display name.

Example

Show assets with display name oracle 8.

oci.compute.displayName:"oracle 8"

oci.compute.faultDomainoci.compute.faultDomain

Use a text value ##### to search all assets with the specified fault domain.

Example

Show all assets with fault domain FAULT-DOMAIN-1

oci.compute.faultDomain:"FAULT-DOMAIN-1"

oci.compute.hasAgentoci.compute.hasAgent

Use the values true | false to list all assets that have cloud agents. Choose True to list all assets having cloud agents and choose False to list all assets that do not have cloud agents.

Example

Show all assets with having cloud agent installed

oci.compute.hasAgent:"true"

oci.compute.hostNameoci.compute.hostName

Use a text value ##### to search all assets with the specified host name.

Example

Show all findings with the host name oracle-8

oci.compute.hostName:"oracle-8"

oci.compute.imageIdoci.compute.imageId

Use a text value ##### to search all assets with the specified image ID.

Example

Show all assets with the  ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq image ID

oci.compute.imageId:"ocid1.image.oc1.iad.aaaaaaaaffp3cnkpfxibzrdkfnxbitkgxk7al33rrhpzhfnrhfv7ml2xdpyq"

oci.compute.ociIdoci.compute.ociId

Use a text value ##### to search all assets with the specified OCI ID.

Example

Show assets with this OCI ID

oci.compute.ociId:"ocid1.compartment.oc1..1234567lbhcx2ajiagh57wrurvqs2ubd4ttaimgy22cxh3r6brpmmugq"

oci.compute.regionoci.compute.region

Use a text value ##### to search all assets in the specified region.

Example

Show all assets with the region us-east-1

oci.compute.region:"us-east-1"

oci.compute.regionKeyoci.compute.regionKey

Use a text value ##### to search all assets with the specified region key.

Example

Show all assets with the region key SYD

oci.compute.regionKey:"SYD"

oci.compute.regionRealmoci.compute.regionRealm

Use a text value ##### to search all groups with the specified region realm.

Example

Show all assets with the region realm OC1

oci.compute.regionRealm:"OC1"

oci.compute.shapeoci.compute.shape

Use a text value ##### to search all assets with the specified shape.

Example

Show all assets with the shape x5-2.36.512

oci.compute.shape:"x5-2.36.512"

oci.compute.stateoci.compute.state

Use a text value ##### to search all assets with specific compute state.

Example

Show all assets with the compute state Starting

oci.compute.state:STARTING

oci.compute.tenantIdoci.compute.tenantId

Use a text value ##### to search all assets with specific tenant ID.

Example

Show all assets with the specific tenant ID

oci.compute.tenantId:"ocid1.tenancy.oc1..aaaaaaaax2gwhq3hszjqhte5pgzijgyge6gvlsrqar6kxn7itwhk7keokamq"

oci.compute.tenantNameoci.compute.tenantName

Use a text value ##### to search all assets with specific tenant name.

Example

Show all assets with the specific tenant name

oci.compute.tenantName:"oraclecengg1"

oci.tags.keyoci.tags.key

Use a text value ##### to search all assets with the specified tag key.

Example

Show all assets with the tag key CreatedBy

oci.tags(key:CreatedBy)

oci.tags.namespaceoci.tags.namespace

Use a text value ##### to search all assets with the specified namespace.

Example

Show all assets with the namespace Oracle-Tags

oci.tags(namespace:"Oracle-Tags")

oci.tags.typeoci.tags.type

Use a text value ##### to search all assets with specific tag type.

Example

Show all assets with the specific tag type

oci.tags(type:DEFINED)

oci.tags.valueoci.tags.value

Use a text value ##### to search all assets with the specified tag value.

Example

Show all assets with the tag value 2021-02-09

oci.tags(value:"2021-02-09")

oci.vnic.macAddroci.vnic.macAddr

Use a text value ##### to search all assets with the specified MAC address.

Example

Show all assets with the MAC address 02:00:17:06:bd:b3

oci.vnic(macAddr:"02:00:17:06:bd:b3")

oci.vnic.nicIndexoci.vnic.nicIndex

Use a text value ##### to search all assets with the specified index.

Example

Show all assets with the index 1

oci.vnic(nicIndex:1)

oci.vnic.privateIpoci.vnic.privateIp

Use a text value ##### to search all assets with the specified private IP.

Example

Show all assets with this private IP

oci.vnic(privateIp:10.0.0.222)

oci.vnic.publicIpoci.vnic.publicIp

Use a text value ##### to search all assets with the specified public IP.

Example

Show all assets with this public IP

oci.vnic(publicIp:10.0.0.222)

oci.vnic.subnetCidrBlockoci.vnic.subnetCidrBlock

Use a text value ##### to search all assets with the specified block.

Example

Show all assets with the block 10.0.0.0/24

oci.vnic(subnetCidrBlock:10.0.0.0/24)

oci.vnic.subnetIdoci.vnic.subnetId

Use a text value ##### to find OCI instances by the ID of the subnet in which the interface resides.

Example

Find OCI instances with this subnet ID

oci.vnic(subnetId: "subnet-bc02c0d4")

oci.vnic.subnetNameoci.vnic.subnetName

Use a text value ##### to find OCI instances by the name of the subnet in which the interface resides.

Example

Find OCI instances with this subnet name

oci.vnic(subnetName: "subnet-abc")

oci.vnic.vcnIdoci.vnic.vcnId

Use a text value ##### to search all assets with the specified VCN ID.

Example

Show all assets with this VCN ID

oci.vnic(vcnId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")

oci.vnic.vcnNameoci.vnic.vcnName

Use a text value ##### to search all assets with the specified vcn name.

Example

Show all assets with this vcn name

oci.vnic(vcnName:"abc")

oci.vnic.virtualRouterIpoci.vnic.virtualRouterIp

Use a text value ##### to search all assets with the specified router IP.

Example

Show all assets with the router IP 10.0.0.1

oci.vnic(virtualRouterIp:10.0.0.1)

oci.vnic.vlanTagoci.vnic.vlanTag

Use a text value ##### to search all assets with the specified vlan tag.

Example

Show all assets with the vlan tag 1

oci.vnic(vlanTag:1)

oci.vnic.vnicIdoci.vnic.vnicId

Use a text value ##### to search all assets with the specified VNIC ID.

Example

Show all assets with the VNIC ID ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q

oci.vnic(vnicId:"ocid1.vnic.oc1.iad.abuwcljt6cdjcuwhkce37madk4p6bd6ocjknilpwzai5rsyjejteiodyp22q")

ibm.tags.nameibm.tags.name

Use a text value ##### to find IBM instances with a certain tag name (case insensitive).

Examples

Find IBM instances with name "devops"

ibm.tags.name: devops

Find IBM instances with name starting "dev"

ibm:tags.name: dev*

Find IBM instances with name ending "ops"

ibm.tags.name: *ops

ibm.tags.valueibm.tags.value

Use a text value ##### to find IBM instances with a certain tag value (case insensitive).

Examples

Find IBM instances with tag value "dailybuild"

ibm.tags.value: dailybuild

Find IBM instances with tag value starting "daily"

ibm.tags.value: daily*

Find IBM instances with tag value ending "build"

ibm.tags.value: *build

ibm.virtualServer.datacenterIdibm.virtualServer.datacenterId

Use a text value ##### to find IBM instances with datacenter ID .

Example

Find IBM instances with this datacenter ID

ibm.virtualServer.datacenterId: 1854895

ibm.virtualServer.deviceNameibm.virtualServer.deviceName

Use a text value ##### to find IBM instances with virtual server device name.

Examples

Find IBM instances related to name

ibm.virtualServer.deviceName: "virtualserver01.Qualys-Inc.cloud"

Find IBM instances that match exact value

ibm.virtualServer.deviceName: `virtualserver01.Qualys-Inc.cloud`

ibm.virtualServer.domainibm.virtualServer.domain

Use a text value ##### to search all assets with the specified virtual server domain.

Example

Show all assets with virtual server domain Qualys-Inc.cloud

ibm.virtualServer.domain:"Qualys-Inc.cloud"

ibm.virtualServer.idibm.virtualServer.id

Use a text value ##### to search all assets with the specified virtual server ID.

Example

Show all assets with the  8998892 virtual server ID

ibm.virtualServer.id:8998892

ibm.virtualServer.locationibm.virtualServer.location

Use a text value ##### to define the region you're interested in.

Example

Find IBM instances in this location

ibm.virtualServer.location: westus

ibm.virtualServer.privateIpAddressibm.virtualServer.privateIpAddress

Use a text value ##### to define a private IPv4 address or range of IPs you're interested in.

Examples

Find IBM instances with this private IP

ibm.virtualServer.privateIpAddress: 10.240.0.7

Find IBM instances with this private IP range

ibm.virtualServer.privateIpAddress: [10.240.0.7 ... 10.240.0.30]

ibm.virtualServer.privateVlanibm.virtualServer.privateVlan

Use a text value ##### to define a private Vlan you're interested in.

Example

Find the IBM instance with this private Vlan address

ibm.virtualServer.privateVlan: 3455

ibm.virtualServer.publicIpAddressibm.virtualServer.publicIpAddress

Use a text value ##### to define a public IPv4 address or range of IPs you're interested in.

Examples

Find IBM instances with this public IP

ibm.virtualServer.publicIpAddress: 10.240.0.7

Find IBM instances with this public IP range

ibm.virtualServer.publicIpAddress: [10.240.0.7 ... 10.240.0.30]

ibm.virtualServer.publicVlanibm.virtualServer.publicVlan

Use a text value ##### to define a public Vlan you're interested in.

Example

Find the IBM instance with this public Vlan address

ibm.virtualServer.publicVlan: 3455

software:(authorizationDetectionScoresoftware:(authorizationDetectionScore

Use a text value ##### to find the installations of the software product with the QDS you're looking for.

Example

Show the installations of the software product with the following QDS

software:(authorizationDetectionScore: 30)

software:(lifecycle.detectionScoresoftware:(lifecycle.detectionScore

Use a text value ##### to find the software product with the lifecycle detection score you are looking for

Examples

Show the software product with the lifecycle detection score

software:(lifecycle.detectionScore: 80)

Show the software product with the lifecycle detection score

software:(lifecycle.detectionScore>80)

Show the software product with the lifecycle detection score

software:(lifecycle.detectionScore<80)

Show the software product with the lifecycle detection score

software:(lifecycle.detectionScore<=80)

Show the software product with the lifecycle detection score

software:(lifecycle.detectionScore>=80)

software:(authorizationsoftware:(authorization

Use text value ##### to help you find the installations of the software product with authorization you're looking for, i.e. Authorized, Unauthorized, or Needs Review.

Example

Show installations of the software that was marked as Authorized.

software:(authorization:`Authorized`)

Show installations of the software that was marked as Unauthorized.

software:(authorization:`Unauthorized`)

Show installations of the software that needs review.

software:(authorization:`Needs Review`)

openPorts:(authorizationopenPorts:(authorization

Use the values Authorized, Unauthorized, or Needs Review to filter the ports.

Example

Show open ports that are marked Authorized

openPorts:(authorization: "Authorized")

openPorts:(detectionScoreopenPorts:(detectionScore

Filter the open ports based on the QDS score.

Examples

Show open ports based on the following QDS score

openPorts:(detectionScore: 80)

Show open ports based on the following QDS score

openPorts:(detectionScore>80)

Show open ports based on the following QDS score

openPorts:(detectionScore<80)

Show open ports based on the following QDS score

openPorts:(detectionScore>=80)

operatingSystem.lifecycle.detectionScoreoperatingSystem.lifecycle.detectionScore

Use a text value ##### to show findings that match the specified operating system lifecycle detection score

Examples

Show findings with the the operating system lifecycle detection score

operatingSystem.lifecycle.detectionScore: 20)

Show findings with the operating system lifecycle detection score

operatingSystem.lifecycle.detectionScore>20)

Show findings with the operating system lifecycle detection score

operatingSystem.lifecycle.detectionScore<20)

Show findings with the operating system lifecycle detection score

operatingSystem.lifecycle.detectionScore>=20)

Show findings with the operating system lifecycle detection score

operatingSystem.lifecycle.detectionScore<=20)

missingSoftware.detectionScoremissingSoftware.detectionScore

Use a text value ##### to show findings that match the missing software detection score

Examples

Show findings with the the missing software detection score

missingSoftware.detectionScore: 50)

Show findings with the missing software detection score

missingSoftware.detectionScore>50)

Show findings with the missing software detection score

missingSoftware.detectionScore<50)

Show findings with the missing software detection score

missingSoftware.detectionScore>=50)

Show findings with the missing software detection score

missingSoftware.detectionScore<=50)

software:(discoverySourcessoftware:(discoverySources

Use a text value ##### to help you find software detected from a certain discovery source. (Active Directory, BMC Helix, CMDB, Cloud Agent, EASM, ICS OCA, IP Scanner, OCA, Passive Sensor, ServiceNow, Unknown, and Webhook) Select from values in the drop-down menu.

Examples

Show findings from cloud agents

software:(discoverySources: Cloud Agent)

Show findings from Passive Sensor

software:(discoverySources: CMDB)

openPorts:(discoverySourcesopenPorts:(discoverySources

Use a text value ##### to help you find open ports detected from a certain discovery source. (Active Directory, BMC Helix, CMDB, Cloud Agent, EASM, ICS OCA, IP Scanner, OCA, Passive Sensor, ServiceNow, Unknown, and Webhook) Select from values in the drop-down menu.

Examples

Show findings from cloud agents

openPorts:(discoverySources: Cloud Agent)

Show findings from Passive Sensor

openPorts:(discoverySources: CMDB)

Alibaba

Use these tokens when searching Alibaba assets.

alibaba.instance.accountIdalibaba.instance.accountId

Use a text value to define the instance id of the Alibaba cloud account.

Examples

Find Alibaba instances with the following account ID

alibaba.instance.accountId: 123456789012

Find Alibaba instances with account ID starting "12345"

alibaba.instance.accountId: 12345*

alibaba.instance.dnsServeralibaba.instance.dnsServer

Use an integer value to define the Domain Name System (DNS) configurations of the instance.

Example

Find Alibaba instances of the following DNS

alibaba.instance.dnsServer: 100.xxx.x.xxx

alibaba.instance.hasAgentalibaba.instance.hasAgent

Use the boolean value, true | false to define whether the Alibaba instance has a cloud agent installed on it.

Example

Find Alibaba instances with agents

alibaba.instance.hasAgent: true

alibaba.instance.hostNamealibaba.instance.hostName

Use a text value to find Alibaba hostname.

Example

Find Alibaba instances related to name

alibaba.instance.hostName: abc.qualys.com

alibaba.instance.imageIdalibaba.instance.imageId

Use a text value to find the Id of the image used during the instance creation process.

Example

Find instances related to image id

alibaba.instance.imageId: ubuntu_14_0405_64_20G_alibase_20170824.vhd

alibaba.instance.instanceIdalibaba.instance.instanceId

Use a text value to define the Alibaba instance id.

Example

Find Alibaba instances with this instance ID

alibaba.instance.instanceId: i-a2dxxxxsxxxxxhdfax

alibaba.instance.instanceTypealibaba.instance.instanceType

Use a text value to define the instance type.

Example

Find Alibaba instances with this instance type

alibaba.instance.instanceType: ecs.t5-lc1m1.small

alibaba.instance.interfaceIdalibaba.instance.interfaceId

Use a text value to define the identifier of the NIC.

Example

Find Alibaba instances of the following interface id

alibaba.instance.interfaceId: a2dxxxxaixxxtux572

alibaba.instance.instanceStatealibaba.instance.instanceState

Use a text value to define the state of the Alibaba instance. Some of the examples of the state of the instance are: MOVING, RUNNING, STARTED, STOPPED, STOPPING, and TERMINATED.

Example

Find Alibaba instances for the following state

alibaba.instance.instanceState: RUNNING

alibaba.instance.macAddressalibaba.instance.macAddress

Use a text value to define the MAC address.

Example

Find Alibaba instances with this MAC address

alibaba.instance.macAddress: 00:16:3e:0f:XX:XX

alibaba.instance.networkTypealibaba.instance.networkType

Use the network type values to find the Alibaba cloud instances. The network type can be vpc or classic.

Example

Find Alibaba instances with this network type

alibaba.instance.networkType: vpc

alibaba.instance.privateIpAddressalibaba.instance.privateIpAddress

Use an integer value to define a private IPv4 address or range of IPs.

Example

Find Alibaba instances with the following private IP address

alibaba.instance.privateIpAddress: 192.168.XX.XX

alibaba.instance.publicIpAddressalibaba.instance.publicIpAddress

Use an integer value to define a public IPv4 address or range of IPs.

Example

Find Alibaba instances with the following public IP address

alibaba.instance.publicIpAddress: 149.xx.xx.xx

alibaba.instance.region.codealibaba.instance.region.code

Use a text value to find the alibaba cloud instances that belong to the region with specific code. Some of the examples of codes are ap-northeast-1,  ap-south-1, nanjing, cn-chengdu, and eu-central-1.

Example

Find Alibaba instances for the following region code

alibaba.instance.region.code: cn-chengdu

alibaba.instance.region.namealibaba.instance.region.name

Use a text value to define the region name. Australia (Sydney), Beijing, China, Japan (Tokyo), India (Mumbai), and Philippines (Manila).

Example

Find Alibaba instances for the following region

alibaba.instance.region.name: US (Silicon Valley)

alibaba.instance.serialNumberalibaba.instance.serialNumber

Use a text value to define the serial number of the instance.

Example

Find Alibaba instances of the following serial number

alibaba.instance.serialNumber: 12trexxxxr-3xx-xxx-rtg4-xxxx6t45

alibaba.instance.vpcCidrBlockalibaba.instance.vpcCidrBlock

Use a text value to define the serial number of the instance.

Example

Find Alibaba instances of the following CIDR block

alibaba.instance.vpcCidrBlock: 172.xx.x.x/16

alibaba.instance.vpcIdalibaba.instance.vpcId

Use a text value to search all the Alibaba instances with the specified VPC ID.

Example

Show Alibaba instances with this VPC ID

alibaba.instance.vpcId: vpc-a2d6pxxxxvvdadd5yikj

alibaba.instance.vswitchIdalibaba.instance.vswitchId

Use a text value to search all the Alibaba instances with the specified vswitchId.

Example

Show Alibaba instances with of the following switch ID

alibaba.instance.vswitchId: vsw-a2dxxxoxxxxsqx1mxxxdd

alibaba.instance.vswitchCidrBlockalibaba.instance.vswitchCidrBlock

Use an integer value to define the CIDR block of the switch to which the Alibaba instance is connected.

Example

Find Alibaba instances of the following CIDR block of the switch

alibaba.instance.vswitchCidrBlock: 192.168.XX.XX/24

alibaba.instance.zoneIdalibaba.instance.zoneId

Use a text value to define the zone id.

Examples

Find Alibaba instances of the following zone id

alibaba.instance.zoneId: cn-chengdu-a

 

Supported Boolean Operators

The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.

andand

Use a boolean query to express your query using AND logic.

Example

Show assets with operating system Windows and Linux

operatingSystem: windows and operatingSystem: linux

notnot

Narrow down your search by using the 'not' operator in your Boolean query. The result contains all the other values except the one that you specify after 'not' in your query.

Example

not tags.name: Windows

Assets with the Windows tag are excluded from search results.

oror

Use a boolean query to express your query using OR logic.

Example

Show assets with one of these tag names

tag.name: Cloud Agent or tag.name: HQ