Old and New Tokens Mapping
The token standardization for the Qualys Query Language (QQL) search tokens follows a standard naming convention.
The new token format follows the syntax: entity.attribute
For example, in the new token, asset.id, asset is the entity, and id is the attribute.
All tokens now adhere to a standardized naming convention.
- Only new tokens are displayed in the auto-suggestion in the search bars within the UI. However, if you type the old token name manually, the QQL query still works. Old token name visibility from the UI is removed.
- The existing Dashboard widgets and Saved Search Queries will continue to support the old tokens. You can edit search queries and widgets to update the new tokens.
The following is the old and new tokens mapping list:
| Old Token | New Token |
|---|---|
| provider | cloud.provider |
| asset.lastLocation | asset.lastLocation.name |
| sensors.activatedForModules | qualys.activatedForModules |
| asset.riskScore | asset.truRisk |
| interfaces:(address | asset.interface:(address |
| interfaces:(dnsAddress | asset.interface:(dnsAddress |
| interfaces:(gatewayAddress | asset.interface:(gatewayAddress |
| interfaces:(hostname | asset.interface:(hostname |
| interfaces:(interfaceName | asset.interface:(name |
| interfaces:(macAddress | asset.interface:(macAddress |
| interfaces:(manufacturer | asset.interface:(manufacturer |
| interfaces:(netmask | asset.interface:(netmask |
| agent.agentID | qualys.agent.id |
| agent.activations.key | qualys.agent.activationKey.uuid |
| agent.activations.status | qualys.agent.activationKey.status |
| agent.lastActivity | qualys.agent.lastActivityDate |
| agent.lastCheckedIn | qualys.agent.lastCheckedInDate |
| agent.lastInventory | qualys.agent.lastInventoryDate |
| agent.udcManifestAssigned | qualys.agent.isUdcManifestAssigned |
| alibaba.instance.region.code | alibaba.instance.regionCode |
| alibaba.instance.region.name | alibaba.instance.regionName |
| inventory:(created | asset.inventory:(createdDate |
| inventory:(lastUpdated | asset.inventory:(lastUpdatedDate |
| hardware | hardware.name |
| operatingSystem | operatingSystem.name |
| asset.assetID | asset.id |
| asset.biosHardwareUUID | asset.biosHardwareUuid |
| asset.created | asset.createdDate |
| asset.isolated | asset.isIsolated |
| asset.lastUpdated | asset.lastUpdatedDate |
| asset.lparID | qualys.passiveSensor.lparId |
| accounts.username | account.username |
| aws.tags:(key | aws.tag:(key |
| aws.tags:(value | aws.tag:(value |
| aws.ec2.publicDNS | aws.ec2.publicDns |
| aws.ec2.privateDNS | aws.ec2.privateDns |
| azure.tags:(name | azure.tag:(name |
| azure.tags:(value | azure.tag:(value |
| connectors.connector.name | connector.name |
| connectors.connectorId | connector.id |
| connectors.firstDiscovered | connector.firstFoundDate |
| connectors.lastDiscovered | connector.lastFoundDate |
| ibm.tags:(name | ibm.tag:(name |
| ibm.tags:(value | ibm.tag:(value |
| middlewareManifestVersion | qualys.agent.middlewareManifestVersion |
| pcManifestVersion | qualys.agent.pcManifestVersion |
| scaManifestVersion | qualys.agent.scaManifestVersion |
| qualysCorrelationID | qualys.agent.correlationId |
| udcManifestVersion | qualys.agent.udcManifestVersion |
| vmManifestVersion | qualys.agent.vmManifestVersion |
| oci.tags:(key | oci.tag:(key |
| oci.tags:(namespace | oci.tag:(namespace |
| oci.tags:(type | oci.tag:(type |
| oci.tags:(value | oci.tag:(value |
| passiveSensor.lastUpdated | qualys.passiveSensor.lastUpdatedDate |
| processors | processor.name |
| processors.coresPerSocket | processor.coresPerSocket |
| processors.multithreadingStatus | processor.multiThreadingStatus |
| processors.numberOfCpu | processor.noOfCpu |
| processors.numberOfSockets | processor.noOfSockets |
| processors.speed | processor.speed |
| processors.threadsPerCore | processor.threadsPerCore |
| sensors.lastComplianceScan | sensor.lastComplianceScanDate |
| sensors.lastFullScan | sensor.lastFullScanDate |
| sensors.lastPcScanDateAgent | sensor.lastPcAgentScanDate |
| sensors.lastPcScanDateScanner | sensor.lastPcScannerScanDate |
| sensors.lastVmScan | sensor.lastVmScanDate |
| sensors.lastVmScanDateAgent | sensor.lastVmAgentScanDate |
| sensors.lastVmScanDateScanner | sensor.lastVmScannerScanDate |
| sensors.pendingActivationForModules | qualys.pendingActivationForModules |
| software:(firstFound | software:(firstFoundDate |
| software:(lastUpdated | software:(lastUpdatedDate |
| tags.businessImpact | asset.tag.businessImpact |
| tags.name | asset.tag.name |
| volumes:(free | volume:(free |
| volumes:(name | volume:(name |
| volumes:(size | volume:(size |
| inventory:(source | asset.inventory:(source |
| gpu.tensorCores | compute.gpu.tensorCores |
| gpu.model | compute.gpu.name |
| gpu.manufacturer | compute.gpu.manufacturer |
| gpu.isAIModelSupported | compute.gpu.isAIModelSupported |
| gpu.chip | compute.gpu.chip |
| asset.totalMemory | compute.totalMemory |
| asset.timezone | compute.timezone |
| asset.lastBoot | compute.lastBootDate |
| asset.isContainerHost | compute.isContainerHost |
| asset.cpuCount | asset.noOfCpu |
| caps.dnsSuffix | qualys.caps.dnsSuffix |
| agent.version | qualys.agent.version |
| agent.status | qualys.agent.status |
| agent.platform | qualys.agent.platform |
| agent.errorStatus | qualys.agent.errorStatus |
| agent.connectedFrom | qualys.agent.connectedFrom |
| agent.configurationProfile | qualys.agent.configurationProfile |
Certificate TokensCertificate Tokens
| Old Token | New Token |
|---|---|
| asset.assetID | asset.id |
| asset.created | asset.createdDate |
| asset.lastUpdated | asset.lastUpdatedDate |
| asset.riskScore | asset.truRisk |
| inventory:(created | asset.inventory:(createdDate |
| inventory:(lastUpdated | asset.inventory:(lastUpdatedDate |
| operatingSystem | operatingSystem.name |
| provider | cloud.provider |
| sensors.activatedForModules | qualys.activatedForModules |
| tags.name | asset.tag.name |
| instance:(cipherSuites.value | asset.instance:(cipherSuites.value |
| instance:(fqdn | asset.instance:(fqdn |
| instance:(grade | asset.instance:(grade |
| instance:(lastEasmVmScanDate | asset.instance:(lastEasmVmScanDate |
| instance:(port | asset.instance:(port |
| instance:(service | asset.instance:(service |
| instance:(sources | asset.instance:(sources |
| instance:(sslProtocols | asset.instance:(sslProtocol |
| instance:(vulns.qid | asset.instance:(vulns.qid |
| instance:(vulns.severity | asset.instance:(vulns.severity |
| instance:(vulns.title | asset.instance:(vulns.title |
| interfaces:(address | asset.interface:(address |
| interfaces:(hostname | asset.interface:(hostname |
| inventory:(source | asset.inventory:(source |
| asset.org.name | org:(name |
| asset.subdomain | asset.subDomain |
Tag Rule TokensTag Rule Tokens
| Old Token | New Token |
|---|---|
| provider | cloud.provider |
| accounts.username | account.username |
| asset.riskScore | asset.truRisk |
| interfaces:(address | asset.interface:(address |
| interfaces:(gatewayAddress | asset.interface:(gatewayAddress |
| interfaces:(hostname | asset.interface:(hostname |
| interfaces:(interfaceName | asset.interface:(name |
| alibaba.instance.region.code | alibaba.instance.regionCode |
| alibaba.instance.region.name | alibaba.instance.regionName |
| aws.ec2.privateDNS | aws.ec2.privateDns |
| aws.ec2.publicDNS | aws.ec2.publicDns |
| aws.tags:(key | aws.tag:(key |
| aws.tags:(value | aws.tag:(value |
| azure.tags:(name | azure.tag:(name |
| azure.tags:(value | azure.tag:(value |
| ibm.tags:(name | ibm.tag:(name |
| ibm.tags:(value | ibm.tag:(value |
| oci.tags:(key | oci.tag:(key |
| oci.tags:(namespace | oci.tag:(namespace |
| oci.tags:(type | oci.tag:(type |
| oci.tags:(value | oci.tag:(value |
| operatingSystem | operatingSystem.name |
| Old Token | New Token |
|---|---|
| aws.ec2.privateDNS | aws.ec2.privateDns |
| aws.ec2.publicDNS | aws.ec2.publicDns |
| aws.tags:(key | aws.tag:(key |
| aws.tags:(value | aws.tag:(value |
| Old Token | New Token |
|---|---|
| azure.tags:(name | azure.tag:(name |
| azure.tags:(value | azure.tag:(value |
| Old Token | New Token |
|---|---|
| alibaba.instance.region.code | alibaba.instance.regionCode |
| alibaba.instance.region.name | alibaba.instance.regionName |