Old and New Tokens Mapping

The token standardization for the Qualys Query Language (QQL) search tokens follows a standard naming convention.

The new token format follows the syntax: entity.attribute
For example, in the new token, asset.id, asset is the entity, and id is the attribute.

All tokens now adhere to a standardized naming convention. 

  • Only new tokens are displayed in the auto-suggestion in the search bars within the UI. However, if you type the old token name manually, the QQL query still works. Old token name visibility from the UI is removed.
  • The existing Dashboard widgets and Saved Search Queries will continue to support the old tokens. You can edit search queries and widgets to update the new tokens.

The following is the old and new tokens mapping list:

Asset TokensAsset Tokens

Old Token New Token
provider cloud.provider
asset.lastLocation asset.lastLocation.name
sensors.activatedForModules qualys.activatedForModules
asset.riskScore asset.truRisk
interfaces:(address asset.interface:(address
interfaces:(dnsAddress asset.interface:(dnsAddress
interfaces:(gatewayAddress asset.interface:(gatewayAddress
interfaces:(hostname asset.interface:(hostname
interfaces:(interfaceName asset.interface:(name
interfaces:(macAddress asset.interface:(macAddress
interfaces:(manufacturer asset.interface:(manufacturer
interfaces:(netmask asset.interface:(netmask
agent.agentID qualys.agent.id
agent.activations.key qualys.agent.activationKey.uuid
agent.activations.status qualys.agent.activationKey.status
agent.lastActivity qualys.agent.lastActivityDate
agent.lastCheckedIn qualys.agent.lastCheckedInDate
agent.lastInventory qualys.agent.lastInventoryDate
agent.udcManifestAssigned qualys.agent.isUdcManifestAssigned
alibaba.instance.region.code alibaba.instance.regionCode
alibaba.instance.region.name alibaba.instance.regionName
inventory:(created asset.inventory:(createdDate
inventory:(lastUpdated asset.inventory:(lastUpdatedDate
hardware hardware.name
operatingSystem operatingSystem.name
asset.assetID asset.id
asset.biosHardwareUUID asset.biosHardwareUuid
asset.created asset.createdDate
asset.isolated asset.isIsolated
asset.lastUpdated asset.lastUpdatedDate
asset.lparID qualys.passiveSensor.lparId
accounts.username account.username
aws.tags:(key aws.tag:(key
aws.tags:(value aws.tag:(value
aws.ec2.publicDNS aws.ec2.publicDns
aws.ec2.privateDNS aws.ec2.privateDns
azure.tags:(name azure.tag:(name
azure.tags:(value azure.tag:(value
connectors.connector.name connector.name
connectors.connectorId connector.id
connectors.firstDiscovered connector.firstFoundDate
connectors.lastDiscovered connector.lastFoundDate
ibm.tags:(name ibm.tag:(name
ibm.tags:(value ibm.tag:(value
middlewareManifestVersion qualys.agent.middlewareManifestVersion
pcManifestVersion qualys.agent.pcManifestVersion
scaManifestVersion qualys.agent.scaManifestVersion
qualysCorrelationID qualys.agent.correlationId
udcManifestVersion qualys.agent.udcManifestVersion
vmManifestVersion qualys.agent.vmManifestVersion
oci.tags:(key oci.tag:(key
oci.tags:(namespace oci.tag:(namespace
oci.tags:(type oci.tag:(type
oci.tags:(value oci.tag:(value
passiveSensor.lastUpdated qualys.passiveSensor.lastUpdatedDate
processors processor.name
processors.coresPerSocket processor.coresPerSocket
processors.multithreadingStatus processor.multiThreadingStatus
processors.numberOfCpu processor.noOfCpu
processors.numberOfSockets processor.noOfSockets
processors.speed processor.speed
processors.threadsPerCore processor.threadsPerCore
sensors.lastComplianceScan sensor.lastComplianceScanDate
sensors.lastFullScan sensor.lastFullScanDate
sensors.lastPcScanDateAgent sensor.lastPcAgentScanDate
sensors.lastPcScanDateScanner sensor.lastPcScannerScanDate
sensors.lastVmScan sensor.lastVmScanDate
sensors.lastVmScanDateAgent sensor.lastVmAgentScanDate
sensors.lastVmScanDateScanner sensor.lastVmScannerScanDate
sensors.pendingActivationForModules qualys.pendingActivationForModules
software:(firstFound software:(firstFoundDate
software:(lastUpdated software:(lastUpdatedDate
tags.businessImpact asset.tag.businessImpact
tags.name asset.tag.name
volumes:(free volume:(free
volumes:(name volume:(name
volumes:(size volume:(size
inventory:(source asset.inventory:(source
gpu.tensorCores compute.gpu.tensorCores
gpu.model compute.gpu.name
gpu.manufacturer compute.gpu.manufacturer
gpu.isAIModelSupported compute.gpu.isAIModelSupported
gpu.chip compute.gpu.chip
asset.totalMemory compute.totalMemory
asset.timezone compute.timezone
asset.lastBoot compute.lastBootDate
asset.isContainerHost compute.isContainerHost
asset.cpuCount asset.noOfCpu
caps.dnsSuffix qualys.caps.dnsSuffix
agent.version qualys.agent.version
agent.status qualys.agent.status
agent.platform qualys.agent.platform
agent.errorStatus qualys.agent.errorStatus
agent.connectedFrom qualys.agent.connectedFrom
agent.configurationProfile qualys.agent.configurationProfile

Certificate TokensCertificate Tokens

 
Old Token New Token
asset.assetID asset.id
asset.created asset.createdDate
asset.lastUpdated asset.lastUpdatedDate
asset.riskScore asset.truRisk
inventory:(created asset.inventory:(createdDate
inventory:(lastUpdated asset.inventory:(lastUpdatedDate
operatingSystem operatingSystem.name
provider cloud.provider
sensors.activatedForModules qualys.activatedForModules
tags.name asset.tag.name
instance:(cipherSuites.value asset.instance:(cipherSuites.value
instance:(fqdn asset.instance:(fqdn
instance:(grade asset.instance:(grade
instance:(lastEasmVmScanDate asset.instance:(lastEasmVmScanDate
instance:(port asset.instance:(port
instance:(service asset.instance:(service
instance:(sources asset.instance:(sources
instance:(sslProtocols asset.instance:(sslProtocol
instance:(vulns.qid asset.instance:(vulns.qid
instance:(vulns.severity asset.instance:(vulns.severity
instance:(vulns.title asset.instance:(vulns.title
interfaces:(address asset.interface:(address
interfaces:(hostname asset.interface:(hostname
inventory:(source asset.inventory:(source
asset.org.name org:(name
asset.subdomain asset.subDomain

Tag Rule TokensTag Rule Tokens

Old Token New Token
provider cloud.provider
accounts.username account.username
asset.riskScore asset.truRisk
interfaces:(address asset.interface:(address
interfaces:(gatewayAddress  asset.interface:(gatewayAddress
interfaces:(hostname asset.interface:(hostname
interfaces:(interfaceName asset.interface:(name
alibaba.instance.region.code alibaba.instance.regionCode
alibaba.instance.region.name alibaba.instance.regionName
aws.ec2.privateDNS aws.ec2.privateDns
aws.ec2.publicDNS aws.ec2.publicDns
aws.tags:(key aws.tag:(key
aws.tags:(value aws.tag:(value
azure.tags:(name azure.tag:(name
azure.tags:(value azure.tag:(value
ibm.tags:(name ibm.tag:(name
ibm.tags:(value ibm.tag:(value
oci.tags:(key oci.tag:(key
oci.tags:(namespace oci.tag:(namespace
oci.tags:(type oci.tag:(type
oci.tags:(value oci.tag:(value
operatingSystem operatingSystem.name

AWS TokensAWS Tokens

Old Token New Token
aws.ec2.privateDNS aws.ec2.privateDns
aws.ec2.publicDNS aws.ec2.publicDns
aws.tags:(key aws.tag:(key
aws.tags:(value aws.tag:(value

Azure TokensAzure Tokens

Old Token New Token
azure.tags:(name azure.tag:(name
azure.tags:(value azure.tag:(value

Alibaba TokensAlibaba Tokens

Old Token New Token
alibaba.instance.region.code alibaba.instance.regionCode
alibaba.instance.region.name alibaba.instance.regionName