Looking for a listing of search fields? Click here
How to Search for Patch Management
Search by Field | String matching | Exact matching | Full Text Search | Is Null Queries | Range searches | Date searches | Match multiple values | Boolean operators | Nested Queries | Limitations | Include or Exclude OS Patches
Search by Field
Enter the field name, then a colon, then your query. Nested fields are dot separated.
Examples:
asset.netbiosName: WIN7PATCH69-85
asset.lastLoggedOnUser: .\Administrator
String matching
Use single quotes or double quotes around your query to match a string.
Examples:
asset.tag.name: "Cloud Agent"
operatingSystem.name: 'Microsoft Windows'
hardware.manufacturer: "Dell"
Example using wildcard: If you want to search for exact count you should use asterisk (*). For example to find assets with name starting with WINDOWS2008 use this query:
asset.name:WINDOWS2008*
Exact matching
Use backticks to exactly match a string. Your results will include any asset with the EXACT value returned.
Examples:
operatingSystem.name: `Windows 7 Ultimate Service Pack 1`
hardware.manufacturer: `dell`
Full Text Search
Many asset fields containing text allow you to use full text search and advanced search capabilities.
Examples:
Show any findings with this OS name
operatingSystem.name: Windows
Show any findings that contain components of OS name
operatingSystem.name: "Windows 2008 r2 service pack 2"
Show any findings that match exact value "Windows 2002"
operatingSystem.name: `Windows 2002`
Is Null Queries
Want to match an empty/null value for a field? You'll need to remove the colon and then write "is null". For example, quickly find assets where the OS has not been identified.
Examples:
operatingSystem.name is null
patch.cveId is null
patch.product is null
Range searches
Ranges can be specified with the [lower .. upper] syntax using () and/or [] as follows. This is supported for numeric and date fields.
Example:
job.endDateTime: [2018-08-01 .. 2018-09-01] // Between August 1st and September 1st 2018
Range options:
job.endDateTime:(date1 .. date2) // Greater than but not equal to date1 and less than but not equal to date2
job.endDateTime:(date1 .. date2] // Greater than but not equal to date1 and less than or equal to date2
job.endDateTime:[date1.. date2) // Greater than or equal to date1 and less than but not equal to date2
job.endDateTime:[date1 .. date2] // Greater than but or equal to date1 and less than or equal to date2
job.endDateTime > date1 // Greater than date1
job.endDateTime >= date1 // Greater than or equal to date1
job.endDateTime < date1 // Less than date1
job.endDateTime <= date1 // Less than or equal to date1
Date searches
Use a date range [start date .. end date] or a specific date. Several date variables are also available.
Examples:
patch.updatedDate: "2018-10-20"
patch.updatedDate <= "2018-11-20"
patch.updatedDate: ["2018-10-20" .. "2018-10-24"]
patch.updatedDate: [now-3d .. now-1s]
Match multiple values
Use to match values "In" or "Not In" fields. Available for all fields except analyzed fields (i.e. full text search fields).
Examples:
Find assets with at least one of these three CVE IDs:
patch.cveId:[CVE-2003-0818 , CVE-2002-0126, CVE-1999-1058]
Find patches last modified on date: 2018-08-31 or 2018-09-12
NOT patch.updatedDate: ["2018-08-31","2018-09-12"]
Supported date formats:
YYYY example: job.endDateTime:["2017","2018"] // in 2017 or 2018
YYYY-MM example: job.endDateTime:["2018-08","2018-09"] // in month of Aug or Sept
YYYY-MM-DD example: job.endDateTime:["2018-10-30","2018-11-05"] // on one of exact dates
Boolean Operators
Use keywords AND, OR, NOT to narrow or broaden your search. Click the link below for info on max query depth, using NOT with vulnerability queries.
Examples:
Show findings that have one of these operating systems:
operatingSystem.name: `Windows 2002` OR operatingSystem.name: `Windows 7 Ultimate Service Pack 1`
Show patches not last modified on or before the date:
AND NOT patch.updatedDate <= "2018-11-05"
Nested Queries
Use a single nested query, using parentheses, to include multiple fields in your query. This is supported only for the tags token, fields tags.name and tags.id, per below.
Example:
Find assets having a certain tag name or ID:
tags: (asset.name: `Cloud Agent` or job.id: `79eb654f-6eca-4922-9adf-0d39bd7cf3f2`)
Limitations
When you select an asset tag during job creation, corresponding child tags get automatically selected for that job. However you can search assets, patches, and jobs only using parent tags. Child tag search in not supported.
Include or Exclude OS Patches
- If you want to include the macOS update patches:
Add the "vendor is null" QQL token along with your original QQL using the OR operator.
Example:
patch.vendor:`Apple` OR vendor is null - If you want to exclude the macOS update patches:
Add the "not vendor is null" QQL token along with your original QQL using the AND operator.
Example:
not patch.vendor:`Apple` AND not vendor is null