Auto Remediation Search Tokens
Use the following search tokens for the auto-remediation rule.
qualys.agent.idqualys.agent.id
Use a text value to find an agent ID.
Example
To show events for a certain agent ID see the following example:
qualys.agent.id: f0c8e682-e9cc-4e7d-b92a-0c905d81ec74
asset.interface.hostnameasset.interface.hostname
Use a string value to list alerts by hostname.
Examples
Show alerts for the specified hostname.
asset.interface.hostname: "DESKTOP-CM8KHGS"
Use a string value to list the assets with the asset name.
Example
asset.name: "WORKSTATION-PC01"
Use a text value to define the action associated with the event, such as a process running.
Example
Show events where the event action is running.
event.action: running
Use a text value to define the source from which the event originates, such as EDR or Anti-Malware.
Example
Show events that originate from the EDR source.
event.source: EDR
Use a text value to define the MD5 hash of a file.
Example
To show events on files with this MD5 hash see the following example:
file.hash.md5: 50714f6cbb72be3e432d58e543dd2632
file.hash.sha256file.hash.sha256
Use a text value to define the SHA256 hash of a file.
Example
To show events on files with SHA256 hash see the following example:
file.hash.sha256: 813xxxx364c2xxxx86xxx2f5xxxxxxf4649ffxxxxx3e6
Use a text value to help you find events on a file name.
Example
To show events on file name see the following example:
file.name: myapp_log.txt
Use a text value to define the full pathname to a file of interest.
Example
Show events on files at this full path
file.fullPath: C:\Windows\System32\LogFiles\myapp_log.txt
file.properties.certificate.hashfile.properties.certificate.hash
Use a text value to define a signed certificate hash of interest.
Example
Show events for this signed certificate hash
file.properties.certificate.hash: 77ca91919c4321f081566603adb3a676767c542
Use a text value to find events on files at a file path you are interested in.
Example
Show events on files at this path
file.path: C:\Windows\System32\LogFiles
Use quotes or backticks with value to define a malware family.
Example
Show events with this malware name
malware.family: CryptoMinerF
malware.categorymalware.category
Use quotes or backticks with value to define a malware category.
Example
Show events with this malware category
malware.category: File Infector
indicator.severityScoreindicator.severityScore
Use an integer value to define the threat score of an indicator based on all scoring engines.
Examples
Show events with this severity score
indicator.severityScore: 8
Show events with confirmed severity scores
indicator.severityScore >= 8
Use a string value to define a process image name of interest.
Example
To show events with a process image name see the following example:
process.name: explorer.exe
Use an integer value to define the process ID.
Example
Show events with this process ID
process.pid: 1655
process.image.fullpathprocess.image.fullpath
Use a string value to define the full path to the file that launched the process. Enclose the path in double quotes.
Example
Show events with image file at this full path
process.image.fullPath: C:\windows\system32\svchost.exe
process.processfile.sha256process.processfile.sha256
Use a text value to define the SHA256 associated with the file process.
Example
Show events for module with SHA256
process.processfile.sha256: 43f0af018dc498619222cf16e1c9bde2f7710732686dc361e4d692b7efb4ddf9
process.processfile.mdprocess.processfile.md
Use a text value to define the MD5 associated with the file process.
Example
Show events for module with this MD5
process.processfile.md: e5c3b321907c73e782280be427599f14
process.image.pathprocess.image.path
Use a string value to define the path to the folder containing the file that launched the process. Enclose the path in double quotes.
Example
Show events with image file contained in this folder
process.image.path: C:\windows\system32
indicator.scoreindicator.score
Use a numeric value to find remediation actions based on the indicator risk score.
Examples
Find remediation for high-score indicators.
indicator.score:>50
Find remediation for a specific score.
indicator.score:75
Find remediation for low-score indicators.
indicator.score:<20
Use a string value to list triggered remediations with rule name.
Examples
Find remediation triggered by a specific rule.
rule.name:SuspiciousProcessInjection
Find remediation for injection-related rules.
rule.name:*Injection*
Use a string value to filter remediation action by platform.
Examples
Find remediation on Windows assets.
platform.type:Windows
Find remediation on Linux assets.
platform.type:Linux
Use a string value to find the remediation actions associated with a specific bulk job name.
Examples
Find remediation from a specific bulk job.
job.name:Ransomeware Response - June 2026
Find remediation from jobs matching a pattern.
job.name:*Ransomeware*