Old and New Tokens Mapping
The token standardization for the Qualys Query Language (QQL) search tokens follows a standard naming convention.
The new token format follows the syntax: entity.attribute
For example, in the new token, asset.id, asset is the entity, and id is the attribute.
All tokens now adhere to a standardized naming convention.
- Only new tokens are displayed in the auto-suggestion in the search bars within the UI. However, if you type the old token name manually, the QQL query still works. Old token name visibility from the UI is removed.
- The existing Dashboard widgets and Saved Search Queries will continue to support the old tokens. You can edit search queries and widgets to update the new tokens.
The following is the old and new tokens mapping list:
| Old Token | New Token |
|---|---|
| provider | cloud.provider |
| asset.lastLocation | asset.lastLocation.name |
| sensors.activatedForModules | qualys.activatedForModules |
| asset.riskScore | asset.truRisk |
| interfaces:(address | asset.interface:(address |
| interfaces:(dnsAddress | asset.interface:(dnsAddress |
| interfaces:(gatewayAddress | asset.interface:(gatewayAddress |
| interfaces:(hostname | asset.interface:(hostname |
| interfaces:(interfaceName | asset.interface:(name |
| interfaces:(macAddress | asset.interface:(macAddress |
| interfaces:(manufacturer | asset.interface:(manufacturer |
| interfaces:(netmask | asset.interface:(netmask |
| agent.agentID | qualys.agent.id |
| agent.activations.key | qualys.agent.activationKey.uuid |
| agent.activations.status | qualys.agent.activationKey.status |
| agent.lastActivity | qualys.agent.lastActivityDate |
| agent.lastCheckedIn | qualys.agent.lastCheckedInDate |
| agent.lastInventory | qualys.agent.lastInventoryDate |
| agent.udcManifestAssigned | qualys.agent.isUdcManifestAssigned |
| alibaba.instance.region.code | alibaba.instance.regionCode |
| alibaba.instance.region.name | alibaba.instance.regionName |
| inventory:(created | asset.inventory:(createdDate |
| inventory:(lastUpdated | asset.inventory:(lastUpdatedDate |
| hardware | hardware.name |
| operatingSystem | operatingSystem.name |
| asset.assetID | asset.id |
| asset.biosHardwareUUID | asset.biosHardwareUuid |
| asset.created | asset.createdDate |
| asset.isolated | asset.isIsolated |
| asset.lastUpdated | asset.lastUpdatedDate |
| asset.lparID | qualys.passiveSensor.lparId |
| accounts.username | account.username |
| aws.tags:(key | aws.tag:(key |
| aws.tags:(value | aws.tag:(value |
| aws.ec2.publicDNS | aws.ec2.publicDns |
| aws.ec2.privateDNS | aws.ec2.privateDns |
| azure.tags:(name | azure.tag:(name |
| azure.tags:(value | azure.tag:(value |
| connector.name | connector:(name |
| connector.id | connector:(id |
| connector.firstFoundDate | connector:(firstFoundDate |
| connector.lastFoundDate | connector:(lastFoundDate |
| ibm.tags:(name | ibm.tag:(name |
| ibm.tags:(value | ibm.tag:(value |
| middlewareManifestVersion | qualys.agent.middlewareManifestVersion |
| pcManifestVersion | qualys.agent.pcManifestVersion |
| scaManifestVersion | qualys.agent.scaManifestVersion |
| qualysCorrelationID | qualys.agent.CorrelationId |
| udcManifestVersion | qualys.agent.udcManifestVersion |
| vmManifestVersion | qualys.agent.vmManifestVersion |
| oci.tags:(key | oci.tag:(key |
| oci.tags:(namespace | oci.tag:(namespace |
| oci.tags:(type | oci.tag:(type |
| oci.tags:(value | oci.tag:(value |
| passiveSensor.lastUpdated | qualys.passiveSensor.lastUpdatedDate |
| processors | processor.name |
| processors.coresPerSocket | processor.coresPerSocket |
| processors.multithreadingStatus | processor.multiThreadingStatus |
| processors.numberOfCpu | processor.noOfCpu |
| processors.numberOfSockets | processor.noOfSockets |
| processors.speed | processor.speed |
| processors.threadsPerCore | processor.threadsPerCore |
| sensors.lastComplianceScan | sensor.lastComplianceScanDate |
| sensors.lastFullScan | sensor.lastFullScanDate |
| sensors.lastPcScanDateAgent | sensor.lastPcAgentScanDate |
| sensors.lastPcScanDateScanner | sensor.lastPcScannerScanDate |
| sensors.lastVmScan | sensor.lastVmScanDate |
| sensors.lastVmScanDateAgent | sensor.lastVmAgentScanDate |
| sensors.lastVmScanDateScanner | sensor.lastVmScannerScanDate |
| sensors.pendingActivationForModules | qualys.pendingActivationForModules |
| software:(firstFound | software:(firstFoundDate |
| software:(lastUpdated | software:(lastUpdatedDate |
| tags.businessImpact | asset.tag.businessImpact |
| tags.name | asset.tag.name |
| volumes:(free | volume:(free |
| volumes:(name | volume:(name |
| volumes:(size | volume:(size |
| inventory:(source | asset.inventory:(source |
| gpu.tensorCores | compute.gpu.tensorCores |
| gpu.model | compute.gpu.name |
| gpu.manufacturer | compute.gpu.manufacturer |
| gpu.isAIModelSupported | compute.gpu.isAIModelSupported |
| gpu.chip | compute.gpu.chip |
| asset.totalMemory | compute.totalMemory |
| asset.timezone | compute.timezone |
| asset.lastBoot | compute.lastBootDate |
| asset.isContainerHost | compute.isContainerHost |
| asset.cpuCount | asset.noOfCpu |
| caps.dnsSuffix | qualys.caps.dnsSuffix |
| agent.version | qualys.agent.version |
| agent.status | qualys.agent.status |
| agent.platform | qualys.agent.platform |
| agent.errorStatus | qualys.agent.errorStatus |
| agent.connectedFrom | qualys.agent.connectedFrom |
| agent.configurationProfile | qualys.agent.configurationProfile |
| passiveSensor.id | qualys.passiveSensor.id |
| passiveSensor.location | qualys.passiveSensor.location |
| passiveSensor.name | qualys.passiveSensor.name |
| asset.lastLoggedOnUser | compute.lastLoggedOnUser |
| asset.managedBy | asset.businessInfo.managedBy.username |
| asset.operationalStatus | asset.businessInfo.operationalStatus |
| asset.ownedBy | asset.businessInfo.ownedBy.username |
| asset.supportGroup | asset.businessInfo.supportGroup |
| asset.supportedBy | asset.businessInfo.supportedBy.username |
| services:(description | compute.service:(description |
| services:(name | compute.service:(name |
| services:(status | compute.service:(status |
| openPorts:(description | asset.openPorts:(description |
| openPorts:(detectedService | asset.openPorts:(detectedService |
| openPorts:(discoverySources | asset.openPorts:(discoverySources |
| openPorts:(firstFound | asset.openPorts:(firstFoundDate |
| openPorts:(lastUpdated | asset.openPorts:(lastUpdatedDate |
| openPorts:(port | asset.openPorts:(port |
| openPorts:(protocol | asset.openPorts:(protocol |
| asset.org.company | org:(company |
| asset.org.department | org:(department |
| asset.domainRole | compute.domainRole |
Certificate TokensCertificate Tokens
| Old Token | New Token |
|---|---|
| asset.assetID | asset.id |
| asset.created | asset.createdDate |
| asset.lastUpdated | asset.lastUpdatedDate |
| asset.riskScore | asset.truRisk |
| inventory:(created | asset.inventory:(createdDate |
| inventory:(lastUpdated | asset.inventory:(lastUpdatedDate |
| operatingSystem | operatingSystem.name |
| provider | cloud.provider |
| sensors.activatedForModules | qualys.activatedForModules |
| tags.name | asset.tag.name |
| instance:(cipherSuites.value | asset.instance:(cipherSuites.value |
| instance:(fqdn | asset.instance:(fqdn |
| instance:(grade | asset.instance:(grade |
| instance:(lastEasmVmScanDate | asset.instance:(lastEasmVmScanDate |
| instance:(port | asset.instance:(port |
| instance:(service | asset.instance:(service |
| instance:(sources | asset.instance:(sources |
| instance:(sslProtocols | asset.instance:(sslProtocol |
| instance:(vulns.qid | asset.instance:(vulns.qid |
| instance:(vulns.severity | asset.instance:(vulns.severity |
| instance:(vulns.title | asset.instance:(vulns.title |
| interfaces:(address | asset.interface:(address |
| interfaces:(hostname | asset.interface:(hostname |
| inventory:(source | asset.inventory:(source |
| asset.org.name | org:(name |
| asset.subdomain | asset.subDomain |
Tag Rule TokensTag Rule Tokens
| Old Token | New Token |
|---|---|
| provider | cloud.provider |
| accounts.username | account.username |
| asset.riskScore | asset.truRisk |
| interfaces:(address | asset.interface:(address |
| interfaces:(gatewayAddress | asset.interface:(gatewayAddress |
| interfaces:(hostname | asset.interface:(hostname |
| interfaces:(interfaceName | asset.interface:(name |
| alibaba.instance.region.code | alibaba.instance.regionCode |
| alibaba.instance.region.name | alibaba.instance.regionName |
| aws.ec2.privateDNS | aws.ec2.privateDns |
| aws.ec2.publicDNS | aws.ec2.publicDns |
| aws.tags:(key | aws.tag:(key |
| aws.tags:(value | aws.tag:(value |
| azure.tags:(name | azure.tag:(name |
| azure.tags:(value | azure.tag:(value |
| ibm.tags:(name | ibm.tag:(name |
| ibm.tags:(value | ibm.tag:(value |
| oci.tags:(key | oci.tag:(key |
| oci.tags:(namespace | oci.tag:(namespace |
| oci.tags:(type | oci.tag:(type |
| oci.tags:(value | oci.tag:(value |
| operatingSystem | operatingSystem.name |
| Old Token | New Token |
|---|---|
| aws.ec2.privateDNS | aws.ec2.privateDns |
| aws.ec2.publicDNS | aws.ec2.publicDns |
| aws.tags:(key | aws.tag:(key |
| aws.tags:(value | aws.tag:(value |
| Old Token | New Token |
|---|---|
| azure.tags:(name | azure.tag:(name |
| azure.tags:(value | azure.tag:(value |
| Old Token | New Token |
|---|---|
| alibaba.instance.region.code | alibaba.instance.regionCode |
| alibaba.instance.region.name | alibaba.instance.regionName |