ETM Findings – QQL Token Mapping Reference
This reference maps the Qualys data model field keys used in connector finding ingestion to their corresponding Qualys Query Language (QQL) tokens in Qualys Enterprise TruRisk Management (ETM). Use these tokens to filter, search, and build queries against ingested findings in the ETM Findings view.
The tables below are organized by field category. Each entry identifies the data model key, the ETM UI label, a description of the field's meaning and importance, and the QQL token available for querying in ETM.
Where a QQL token is listed as Token Unavailable, the field is ingested and stored in the data model but is not currently exposed as a queryable token in the ETM QQL interface.
Core Identity and Description
These fields provide the primary identity and descriptive context for each finding. The externalFindingId is the most reliable unique identifier for deduplication across sources.
Asset and Host Identity
These fields provide the primary identity and naming context for a host asset. externalAssetId is the critical deduplication key and must be marked as a required identifier in the transform map.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
hostName |
asset.interface:(hostname:) |
Hostname or asset name. Human-friendly identity used for reporting, but not always unique across environments. Maps from OS hostname or agent hostname. |
netBiosName |
asset.netbiosName |
NetBIOS name of the host. Used for legacy Windows identity correlation. Maps from Active Directory or Windows inventory data. |
domain |
asset.domain |
Active Directory domain or DNS domain the asset belongs to. Used for correlation, grouping, and reporting. Maps from AD domain or DNS suffix. |
domainRole |
compute.domainRole |
Role of the asset within the domain (for example, workstation, server, domain controller). Useful for enrichment and risk prioritization. Maps from AD or Windows role flags. |
type |
operatingSystem.category2 |
System type classification (for example, server, workstation). Used for reporting and risk segmentation. Maps from inventory classification data. |
cloudProvider |
cloud.provider |
Cloud vendor hosting the asset. Drives cloud-specific logic and validation. Accepted values are EC2, GCP, AZURE, IBM, OCI, ALIBABA. Defaults to SOURCE_TYPE_UNKNOWN. |
instanceId |
aws.ec2.instanceId / gcp.compute.instanceId / alibaba.instance.instanceId |
Cloud instance identifier for the asset. Used for correlation in cloud environments. Maps from EC2 instance ID, VM ID, or equivalent cloud provider identifier. |
lastLoggedOnUser |
asset.lastLoggedOnUser / compute.lastLoggedOnUser |
Last interactive user logged on to the asset. Provides ownership hints and enrichment. The token compute.lastLoggedOnUser applies from UD-2.11HF and CSAM-3.7.1 onwards; use asset.lastLoggedOnUser for earlier releases. |
Network Interfaces
Network interface fields capture per-NIC identity and network configuration. IP and MAC addresses are the primary correlation signals for finding-to-asset matching.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
networkInterfaces[].ipAddress |
asset.interface:(address:) |
IP address per network interface card. Used for identifier correlation and joining findings to assets, though IP addresses can change over time. |
networkInterfaces[].macAddress |
asset.interface:(macAddress:) |
MAC address per NIC. Strong identity signal on LAN and effective for deduplication. Maps from NIC hardware address. |
networkInterfaces[].interfaceName |
asset.interface:(name:) |
Name of the network interface (for example, eth0, en0). Used for enrichment and troubleshooting. Maps from OS interface labels. |
networkInterfaces[].gatewayAddress |
asset.interface:(gatewayAddress:) |
Default gateway address for the interface. Provides network context for segmentation analysis. Maps from NIC configuration. |
networkInterfaces[].dnsAddress |
asset.interface:(dnsAddress:) |
DNS server address configured for the interface. Used for enrichment. Maps from NIC configuration. |
networkInterfaces[].hostName |
asset.interface:(hostname:) |
Hostname associated with the specific interface. Used for enrichment. Maps from DHCP, DNS, or NIC data. |
Operating System, BIOS, and Hardware
These fields describe the operating system and physical or virtual hardware characteristics of the asset. OS name and version are critical for vulnerability applicability determination.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
operatingSystem.name |
operatingSystem.name |
Full OS name (for example, Windows Server 2019, Ubuntu). Used for reporting and vulnerability applicability matching. |
operatingSystem.version |
operatingSystem.version |
OS version string. Used for vulnerability applicability assessment and patch management tracking. |
operatingSystem.publisher |
operatingSystem.publisher |
OS vendor name (for example, Microsoft, Canonical). Used for reporting and vendor-specific filtering. |
operatingSystem.architecture |
operatingSystem.architecture |
CPU architecture (for example, x86_64, arm64). Used to assess package and exploit applicability. |
processor.numberOfCpu |
processor.noOfCpu |
Number of CPU cores or sockets. Provides capacity context. Accepts integer values. |
processor.speed |
processor.speed |
CPU speed in GHz. Used for enrichment and capacity reporting. Accepts float values. |
biosInfo.serialNumber |
asset.biosSerialNumber |
Device serial number from BIOS. Provides a strong physical identity signal for endpoints. Maps from OEM serial number data. |
biosInfo.model |
hardware.model |
Hardware model identifier (for example, Dell R740). Used for enrichment and hardware inventory reporting. |
biosInfo.manufacturer |
hardware.manufacturer |
OEM hardware manufacturer (for example, Dell, HP, Lenovo). Used for enrichment reporting. |
biosInfo.lastBoot |
compute.lastBootDate |
Timestamp of the last system boot. Provides operational context for uptime and patch cycle analysis. Accepts epoch or datetime format. |
biosInfo.timeZone |
compute.timezone |
Timezone configured on the device. Used for enrichment and date normalization. Maps from timezone string. |
biosInfo.hardwareUuid |
asset.biosHardwareUUID |
Hardware UUID from SMBIOS. Provides a strong identity signal especially for virtual machines. Maps from SMBIOS UUID data. |
biosInfo.biosAssetTag |
asset.biosAssetTag |
Asset tag assigned in BIOS. Used for CMDB and asset management correlation. Maps from inventory tag data. |
biosInfo.biosDescription |
asset.biosDescription |
BIOS version and description text. Used for enrichment and firmware tracking. |
biosInfo.totalMemory |
compute.totalMemory |
Total physical RAM installed on the asset. Used for enrichment and capacity reporting. Accepts integer values in GB or MB. |
Business and Ownership Metadata
Business metadata fields support ownership routing, risk segmentation, and CMDB integration. Several tokens have version-dependent behavior introduced in UD-2.11HF and CSAM-3.7.1.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
businessMetaData.company |
asset.org.company |
Owning company name. Used for reporting and organizational segmentation. Maps from CMDB data. |
businessMetaData.department |
asset.org.department |
Owning department. Supports ownership routing and reporting. Maps from CMDB or HR system data. |
businessMetaData.environment |
asset.environment / asset.businessInfo.environment |
Environment classification (for example, production, development, staging). Critical for risk prioritization. Use asset.businessInfo.environment from UD-2.11HF and CSAM-3.7.1 onwards. |
businessMetaData.ownedBy |
asset.ownedBy.username / asset.businessInfo.ownedBy.username |
Asset owner identity. Used for accountability routing. Use asset.businessInfo.ownedBy.username from UD-2.11HF and CSAM-3.7.1 onwards when UAI is enabled. |
businessMetaData.managedBy |
asset.managedBy.username / asset.businessInfo.managedBy.username |
Managing team or individual. Supports IT operations routing. Use asset.businessInfo.managedBy.username from UD-2.11HF and CSAM-3.7.1 onwards when UAI is enabled. |
businessMetaData.supportedBy |
asset.supportedBy.username / asset.businessInfo.supportedBy.username |
Support organization or individual for the asset. Used for service routing. Use asset.businessInfo.supportedBy.username from UD-2.11HF and CSAM-3.7.1 onwards when UAI is enabled. |
businessMetaData.supportGroup |
asset.supportGroup / asset.businessInfo.supportGroup |
Support group name (for example, a ServiceNow group). Used for incident routing. Use asset.businessInfo.supportGroup from UD-2.11HF and CSAM-3.7.1 onwards when UAI is enabled. |
businessMetaData.status |
asset.operationalStatus / asset.businessInfo.operationalStatus |
Operational status of the asset (for example, active, decommissioned). Used to filter decommissioned assets from active risk views. Maps from CMDB lifecycle fields. |
Assigned Location
Location fields capture the physical or geographic assignment of an asset. Name, city, state, and country are queryable; address, ZIP, and coordinates are ingested but not currently exposed as QQL tokens.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
assignedLocation.name |
asset.assignedLocation.name |
Logical name of the assigned location or site. Used for site-level reporting and grouping. |
assignedLocation.city |
asset.assignedLocation.city |
City of the assigned location. Used for geographic reporting and segmentation. |
assignedLocation.state |
asset.assignedLocation.state |
State or province of the assigned location. Used for geographic reporting. |
assignedLocation.country |
asset.assignedLocation.country |
Country of the assigned location. Used for geographic reporting and compliance segmentation. |
Software Inventory
Software inventory fields are stored as an array (softwares[]). Each element represents one installed software item on the asset. These fields support vulnerability applicability matching and software lifecycle management.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
softwares[].name |
software:(name:) |
Software or package name. Core field for software inventory. Maps from package or application name. |
softwares[].version |
software:(version:) |
Software version string. Used for vulnerability applicability determination and patch tracking. |
softwares[].publisher |
software:(publisher:) |
Software vendor or publisher name. Used for CPE matching and vendor-based filtering. |
softwares[].type |
software:(category1:) |
Software type or category (for example, MSI, RPM, application). Used for reporting and classification. |
softwares[].installedDate |
software:(installDate:) |
Date when the software was installed. Used for timeline analysis and patch posture tracking. Accepts epoch format. |
softwares[].firstFoundDate |
software:(firstFoundDate:) |
Date when the software was first observed on the asset. Used for discovery timeline tracking. Accepts epoch format. |
softwares[].lastUpdated |
software:(lastUpdatedDate:) |
Date when the software record was last updated. Used to assess patch posture and software freshness. Accepts epoch format. |
softwares[].lastUsedDate |
software:(lastUsedDate:) |
Date when the software was last used. Supports cleanup and prioritization decisions for unused software. Accepts epoch format. |
Ports and Services
Open port and running service fields are stored as arrays (ports[] and services[]). They provide network exposure context and are used for exploitability assessment and host posture analysis.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
ports[].port |
asset.openPorts:(port:) |
Open port number. Indicates network exposure surface. Accepts integer values. Use asset.openPorts:(port:) from UD-2.11HF and CSAM-3.7.1 onwards. |
ports[].protocol |
asset.openPorts:(protocol:) |
Protocol of the open port (TCP or UDP). Provides exposure context alongside the port number. |
ports[].detectedService |
asset.openPorts:(detectedService:) |
Service detected on the open port (for example, via nmap or banner grab). Provides application-level exposure context. |
ports[].description |
asset.openPorts:(description:) |
Description of the port or detected service. Used for enrichment. Maps from service name or banner data. |
ports[].firstFound |
asset.openPorts:(firstFoundDate:) |
Timestamp when the port was first observed open. Used for exposure timeline analysis. Accepts epoch format. |
ports[].lastUpdated |
asset.openPorts:(lastUpdatedDate:) |
Timestamp of the most recent update to the port record. Used for data freshness tracking. Accepts epoch format. |
services[].name |
compute.service:(name:) |
Name of a running OS service. Indicates host-level exposure and posture. Use compute.service:(name:) from UD-2.11HF and CSAM-3.7.1 onwards. |
services[].status |
compute.service:(status:) |
Status of the service (for example, running, stopped). Provides exposure relevance context for service-based findings. |
services[].description |
compute.service:(description:) |
Description of the service. Used for enrichment and reporting. Maps from service metadata. |
Volumes
Volume fields describe disk and storage volumes attached to the asset. They provide capacity and operational context.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
volumes[].name |
compute.volume:(name:) |
Name or mount point of the disk volume (for example, C:, /, /data). Used for enrichment and storage inventory. |
volumes[].size |
compute.volume:(size:) |
Total size of the volume. Provides capacity context. Accepts long integer values. |
volumes[].free |
compute.volume:(free:) |
Free space remaining on the volume. Used to identify operational risk from low disk space. Accepts long integer values. |
Finding Data Model
The following sections cover all fields in the finding data model. Findings are stored as an array (finding[]) where each element represents one vulnerability or security finding on an asset. These fields are queryable in Risk Management > Findings in ETM.
Core Identity and Description
These fields provide the primary identity and descriptive context for each finding. externalFindingId is the most reliable unique identifier and should be marked as an identifier in the transform map.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].name |
finding.title |
Finding title or name as reported by the source. Useful for display and reporting, but not reliable as a unique identifier because names can repeat across sources. |
finding[].externalFindingId |
finding.externalFindingId |
Unique finding identifier assigned by the source system (for example, scanner finding ID, vulnerability instance ID). Preferred unique identifier for deduplication. Should be marked as an identifier in the transform map. |
finding[].description |
finding.description |
Detailed description of the finding. Provides triage context for analysts. Maps from the description text field in the source. |
finding[].category |
finding.type |
High-level classification of the finding type (for example, Vulnerability, Misconfiguration, Secret). Used for categorization and filtering in ETM. |
finding[].subCategory |
finding.subType |
More specific sub-classification within the finding category (for example, SQL Injection, XSS). Supports granular filtering and reporting. |
Severity, Status, and Scoring
These fields control prioritization and lifecycle state for each finding. Severity and risk score are critical inputs for TruRisk scoring and remediation SLA tracking.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].severity |
finding.severity |
Normalized severity level on a scale of 1–5. Values must conform to the validated enumeration. Maps from source severity normalized to the Qualys 1–5 scale. |
finding[].findingStatus |
finding.status |
Lifecycle state of the finding. Accepted values are NEW, ACTIVE, FIXED, REOPENED, and NONE. Drives workflow and SLA tracking in ETM. |
finding[].riskScore |
finding.qds |
Qualys Detection Score (QDS) derived from CVSS or the source risk score. Used for risk prioritization and TruRisk calculation. Accepts values from 0–100. |
finding[].sourceScoreRange |
finding.sourceScoreRange |
Describes the scoring scale used by the source (for example, 0-10, 0-100). Retained for traceability and score normalization context. |
finding[].sourceSeverity |
finding.sourceSeverity |
Original severity label as reported by the source (for example, Critical, High, Medium). Retained for traceability alongside the normalized finding.severity value. |
Dates and Timeline
Timeline fields capture the full lifecycle of a finding from first detection to last fix. These are critical for SLA measurement and exposure duration calculations. All values accept epoch timestamps.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].firstFoundOn |
finding.firstFoundDate |
Timestamp when the finding was first observed. Used to calculate SLA start time and total exposure duration. Accepts epoch format. |
finding[].lastFoundOn |
finding.lastFoundDate |
Timestamp of the most recent observation of the finding. Indicates data freshness and whether the finding is still actively detected. |
finding[].reopenedOn |
finding.reopenedDate |
Timestamp when a previously fixed finding was reopened. Supports workflow tracking for recurring or regressed vulnerabilities. |
finding[].lastFixedOn |
finding.lastFixedDate |
Timestamp when the finding was last remediated. Used for SLA compliance reporting and remediation trend analysis. |
Network and Service Context
These fields provide network-level context for the finding, indicating the port and protocol associated with the detection. They support exploitability assessment and network segmentation analysis.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].port |
finding.port |
Network port associated with the finding detection. Relevant for network-exposed vulnerabilities and exploitability context. Accepts integer values. |
finding[].protocol |
finding.protocol |
Network protocol associated with the finding (for example, TCP, UDP, HTTP, HTTPS). Provides additional context for port-based and web application findings. |
Recommendation, Rationale, and References
These fields capture remediation guidance, detection rationale, and supporting references. They are primarily used to support analyst triage and remediation planning workflows.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].detectionMethod |
finding.detectionMethod |
Method used to detect the finding (for example, authenticated scan, agent-based, DAST, SAST, passive). Supports confidence assessment and explainability. |
Exception and Ignore
This field controls whether a finding is suppressed from active risk calculations. It maps to the ETM ignore flag, which excludes findings from TruRisk scoring while retaining the finding record for audit purposes.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].exceptionDetail.isFindingToBeIgnored |
finding.isIgnored |
Boolean flag indicating whether the finding should be suppressed from risk scoring and active queues. When set to true, the finding is excluded from TruRisk calculations but retained in the data model for audit purposes. |
Vulnerability-Specific Details
These fields capture CVE, CVSS, and exploit intelligence data specific to vulnerability-type findings. They are nested under finding[].findingType.vulnerability and are the primary inputs for vulnerability risk scoring and correlation.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].findingType.vulnerability.vendorId |
finding.sourceId |
Vendor-assigned vulnerability identifier (for example, vendor advisory ID). Used for correlation with vendor advisories and patch bulletins. |
finding[].findingType.vulnerability.cveId |
finding.cveId |
CVE identifier (for example, CVE-2024-12345). Global correlation key used to match findings across tools and data sources. Critical for TruRisk scoring enrichment. |
finding[].findingType.vulnerability.cvss.cvss2Base |
finding.cvss2BaseScore |
CVSSv2 base score for the vulnerability. Used for legacy scoring and compliance reporting. Accepts float values. |
finding[].findingType.vulnerability.cvss.cvss2Temporal |
finding.cvss2TemporalScore |
CVSSv2 temporal score reflecting current exploit and remediation factors. Accepts float values. |
finding[].findingType.vulnerability.cvss.cvss3Base |
finding.cvss3BaseScore |
CVSSv3 base score for the vulnerability. Primary scoring standard for modern vulnerability risk assessment. Accepts float values. |
finding[].findingType.vulnerability.cvss.cvss3Temporal |
finding.cvss3TemporalScore |
CVSSv3 temporal score reflecting current exploit availability and remediation state. Accepts float values. |
finding[].findingType.vulnerability.cvss.vector |
finding.accessVector |
CVSS vector string encoding all base metric values. Used for traceability and detailed scoring breakdown. |
finding[].findingType.vulnerability.isPatchAvailable |
finding.isPatchAvailable |
Boolean indicating whether a patch is available for the vulnerability. Directly affects actionability and remediation SLA prioritization. |
finding[].findingType.vulnerability.isExploitAvailable |
finding.isExploitAvailable |
Boolean indicating whether a known exploit exists for the vulnerability. Increases risk priority when true. |
finding[].findingType.vulnerability.exploitCodeMaturity |
finding.riskFactor.exploitCodeMaturity |
Maturity level of available exploit code (for example, proof-of-concept, functional, weaponized). Used for risk prioritization based on exploit reliability. |
Affected Product
These fields identify the product or component affected by the finding. They are used for vendor correlation and technology-based filtering in ETM.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].product.name |
finding.vendorProductName |
Name of the product or component affected by the finding. Used for product-level correlation and filtering in ETM. |
finding[].product.vendor |
finding.technologyCategory |
Vendor of the affected product. Used for vendor-based filtering and technology categorization. |
finding[].product.version |
finding.product.version |
Version of the affected product. Used to assess vulnerability applicability against specific product versions. |
Web Application Vulnerability Classification
These fields apply to AppSec findings and provide OWASP and WASC taxonomy classifications. They are used for web application security reporting and compliance mapping.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].findingType.vulnerability.owaspTop10Ids[].name |
finding.owaspTopTenName |
OWASP Top 10 category name associated with the finding. Used for AppSec compliance reporting and vulnerability classification. |
finding[].findingType.vulnerability.wascIds[].name |
finding.wascInfoName |
Web Application Security Consortium (WASC) category name associated with the finding. Used for AppSec taxonomy and reporting. |
Vulnerability-Specific Details
These fields capture CVE, CVSS, and exploit intelligence data specific to vulnerability-type findings. They are nested under finding[].findingType.vulnerability and are the primary inputs for vulnerability risk scoring and correlation.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].findingType.vulnerability.vendorId |
finding.sourceId |
Vendor-assigned vulnerability identifier (for example, vendor advisory ID). Used for correlation with vendor advisories and patch bulletins. |
finding[].findingType.vulnerability.cveId |
finding.cveId |
CVE identifier (for example, CVE-2024-12345). Global correlation key used to match findings across tools and data sources. Critical for TruRisk scoring enrichment. |
finding[].findingType.vulnerability.cvss.cvss2Base |
finding.cvss2BaseScore |
CVSSv2 base score for the vulnerability. Used for legacy scoring and compliance reporting. Accepts float values. |
finding[].findingType.vulnerability.cvss.cvss2Temporal |
finding.cvss2TemporalScore |
CVSSv2 temporal score reflecting current exploit and remediation factors. Accepts float values. |
finding[].findingType.vulnerability.cvss.cvss3Base |
finding.cvss3BaseScore |
CVSSv3 base score for the vulnerability. Primary scoring standard for modern vulnerability risk assessment. Accepts float values. |
finding[].findingType.vulnerability.cvss.cvss3Temporal |
finding.cvss3TemporalScore |
CVSSv3 temporal score reflecting current exploit availability and remediation state. Accepts float values. |
finding[].findingType.vulnerability.cvss.vector |
finding.accessVector |
CVSS vector string encoding all base metric values. Used for traceability and detailed scoring breakdown. |
finding[].findingType.vulnerability.isPatchAvailable |
finding.isPatchAvailable |
Boolean indicating whether a patch is available for the vulnerability. Directly affects actionability and remediation SLA prioritization. |
finding[].findingType.vulnerability.isExploitAvailable |
finding.isExploitAvailable |
Boolean indicating whether a known exploit exists for the vulnerability. Increases risk priority when true. |
finding[].findingType.vulnerability.exploitCodeMaturity |
finding.riskFactor.exploitCodeMaturity |
Maturity level of available exploit code (for example, proof-of-concept, functional, weaponized). Used for risk prioritization based on exploit reliability. |
Affected Product
These fields identify the product or component affected by the finding. They are used for vendor correlation and technology-based filtering in ETM.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].product.name |
finding.vendorProductName |
Name of the product or component affected by the finding. Used for product-level correlation and filtering in ETM. |
finding[].product.vendor |
finding.technologyCategory |
Vendor of the affected product. Used for vendor-based filtering and technology categorization. |
finding[].product.version |
finding.product.version |
Version of the affected product. Used to assess vulnerability applicability against specific product versions. |
Web Application Vulnerability Classification
These fields apply to AppSec findings and provide OWASP and WASC taxonomy classifications. They are used for web application security reporting and compliance mapping.
| Data Model Key | ETM Token Name | Description |
|---|---|---|
finding[].findingType.vulnerability.owaspTop10Ids[].name |
finding.owaspTopTenName |
OWASP Top 10 category name associated with the finding. Used for AppSec compliance reporting and vulnerability classification. |
finding[].findingType.vulnerability.wascIds[].name |
finding.wascInfoName |
Web Application Security Consortium (WASC) category name associated with the finding. Used for AppSec taxonomy and reporting. |