Use the vulnerability and patch tokens in combination to define criteria to create a QQL-based Linux job. Looking for help with writing your query? click here
Example
Find patches for RHSA-2015:2241
advisory: "RHSA-2015:2241"
Example
Find patches for x64
architecture: x64
Example
Show patches of category Security
category: `Security`
Example
Find patches for this CVE ID
cve: CVE-208-0760
Example
Show security patches
isSecurity: true
Examples
Show patches modified within certain dates
modifiedDate: [2018-02-01 ... 2018-02-12]
Show patches modified starting 2018-02-01, ending 1 month ago
modifiedDate: [2018-02-01 ... now-1M]
Show patches modified starting 2 weeks ago, ending 1 second ago
modifiedDate: [now-2w ... now-1s]
Show patches modified on certain date
modifiedDate:'2018-02-22'
Example
Find patches with this ID
patchId: 8fc0797d-2c7b-3c08-8e7b-48c30585a702
Examples
Show patches published within certain dates
publishedDate: [2018-02-01 ... 2018-02-12]
Show patches published starting 2018-02-01, ending 1 month ago
publishedDate: [2018-02-01 ... now-1M]
Show patches published starting 2 weeks ago, ending 1 second ago
publishedDate: [now-2w ... now-1s]
Show patches published on certain date
publishedDate:'2018-02-22'
Example
Find patches for this QID
qid: 3015321
Example
Show patches where reboot is required
rebootRequired: true
Example
Find patches for Redhat
supportedOs: Redhat
Example
Find patches with this vendor assigned severity level
vendorSeverity: Critical
Examples
Find patches related to title
title: Security
Find patches that contain parts of title
title: "Security and Quality Rollup for the .Net Framework"
Find patches that match exact value
title: `Security for the .Net Framework`
Use these tokens to define search criteria for vulnerabilities. You must have a subscription to VMDR app to use these tokens.
vulnerabilities.firstFoundvulnerabilities.firstFound
Examples
Show findings first found within certain dates
vulnerabilities.firstFound:[2017-10-21 ... 2017-10-30]
Show findings first found starting 2015-10-01, ending 1 month ago
vulnerabilities.firstFound:[2015-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
vulnerabilities.firstFound:[now-2w ... now-1s]
Show findings first found on certain date
vulnerabilities.firstFound:'2016-11-11'
vulnerabilities.hostAssetNamevulnerabilities.hostAssetName
Examples
Show any findings related to name
vulnerabilities.hostAssetName:QK2K12QP3-65-53
Show any findings that contain parts of name
vulnerabilities.hostAssetName:"QK2K12QP3-65-53"
Show any findings that match exact value "QK2K12QP3-65-53"
vulnerabilities.hostAssetName:`QK2K12QP3-65-53`
vulnerabilities.hostOSvulnerabilities.hostOS
Examples
Show any findings with this OS name
vulnerabilities.hostOS:Windows 2012
Show any findings that contain components of OS name
vulnerabilities.hostOS:"Windows 2012"
Show any findings that match exact value "Windows 2012"
vulnerabilities.hostOS:`Windows 2012`
vulnerabilities.foundvulnerabilities.found
Examples
Show findings with vulnerabilities detected
vulnerabilities.found:TRUE
vulnerabilities.detectionScorevulnerabilities.detectionScore
Examples
Show vulnerabilities with detection score 80
vulnerabilities.detectionScore:80
Show vulnerabilities with detection score 25
vulnerabilities.detectionScore:25
vulnerabilities.disabledvulnerabilities.disabled
Examples
Show findings with vulnerabilities disabled
vulnerabilities.disabled:TRUE
vulnerabilities.lastFixedvulnerabilities.lastFixed
Examples
Show findings last fixed within certain dates
vulnerabilities.lastFixed:[2015-10-21 ... 2016-01-15]
Show findings last fixed starting 2016-01-01, ending 1 month ago
vulnerabilities.lastFixed:[2016-01-01 ... now-1M]
Show findings last fixed starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFixed:[now-2w ... now-1s]
Show findings last fixed on certain date
vulnerabilities.lastFixed:'2016-01-11'
Show findings last fixed within certain number of days
vulnerabilities.lastFixed: [91..180]
vulnerabilities.lastFoundvulnerabilities.lastFound
Examples
Show findings last found within certain dates
vulnerabilities.lastFound:[2015-10-21 ... 2016-01-15]
Show findings last found starting 2016-01-01, ending 1 month ago
vulnerabilities.lastFound:[2016-01-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFound:[now-2w ... now-1s]
Show findings last found on certain date
vulnerabilities.lastFound:'2016-01-11'
Show findings last found within certain number of days
vulnerabilities.lastFound: [91..180]
Show findings last found on 2017-01-12 with patch available
vulnerabilities: (lastFound:'2017-01-12'
AND vulnerability.patchAvailable:TRUE)
vulnerabilities: (lastFound: AND vulnerability.patchAvailable:TRUE)
vulnerabilities.nonExploitableConfigvulnerabilities.nonExploitableConfig
Examples
Show findings with non exploitable configurations
vulnerabilities.nonExploitableConfig:TRUE
Show findings with exploitable configurations
vulnerabilities.nonExploitableConfig:FALSE
vulnerabilities.nonRunningKernelvulnerabilities.nonRunningKernel
Examples
Show detections found on non-running Kernal
vulnerabilities.nonRunningKernel:TRUE
Show detections found on running Kernal
vulnerabilities.nonRunningKernel:FALSE
vulnerabilities.sslvulnerabilities.ssl
Examples
Show vulnerabilities associated with SSL
vulnerabilities.ssl:TRUE
vulnerabilities.portvulnerabilities.port
Example
Show vulnerabilities found on this port
vulnerabilities.port:443
vulnerabilities.protocolvulnerabilities.protocol
Example
Show vulnerabilities found on TCP protocol
vulnerabilities.protocol:TCP
vulnerabilities.ignoredvulnerabilities.ignored
Example
Show vulnerabilities that are marked as ignored
vulnerabilities.ignored:TRUE
vulnerabilities.instancevulnerabilities.instance
Example
Show vulnerabilities found on this instance
vulnerabilities.instance: 354216
vulnerabilities.severityvulnerabilities.severity
Example
Show findings with severity 5
vulnerabilities.severity:5
vulnerabilities.statusvulnerabilities.status
If you select the status as Fixed, the list will only show vulnerabilities that are fixed in the last 365 days.
Example
Show vulnerabilities with New status
vulnerabilities.status:NEW
vulnerabilities.typeDetectedvulnerabilities.typeDetected
Example
Show findings with this type
vulnerabilities.typeDetected:Confirmed
vulnerabilities.vulnerability.authTypesvulnerabilities.vulnerability.authTypes
Example
Show findings with Windows auth type
vulnerabilities.vulnerability.authTypes:WINDOWS_AUTH
vulnerabilities.vulnerability.bugTraqIdsvulnerabilities.vulnerability.bugTraqIds
Example
Show findings with BugTraq ID 22211
vulnerabilities.vulnerability.bugTraqIds:22211
vulnerabilities.vulnerability.categoryvulnerabilities.vulnerability.category
Example
Show findings with category CGI
vulnerabilities.vulnerability.category:CGI
Examples
Show any findings related to this description
vulnerabilities.vulnerability.compliance.description:malicious
software
Show any findings that contain "malicious" or "software" in description
vulnerabilities.vulnerability.compliance.description:"malicious
software"
Show any findings that match exact value "malicious software"
vulnerabilities.vulnerability.compliance.description:`malicious
software`
vulnerabilities.vulnerability.compliance.sectionvulnerabilities.vulnerability.compliance.section
Examples
Show any findings related to this section
vulnerabilities.vulnerability.compliance.section:164.308
Show any findings that contain parts of section
vulnerabilities.vulnerability.compliance.section:"164.308"
Show any findings that match exact value "164.308"
vulnerabilities.vulnerability.compliance.section:`164.308`
vulnerabilities.vulnerability.compliance.typevulnerabilities.vulnerability.compliance.type
Example
Show findings with the compliance type HIPAA
vulnerabilities.vulnerability.compliance.type:HIPAA
vulnerabilities.vulnerability.impactvulnerabilities.vulnerability.impact
Example
Show any findings related to impact
vulnerabilities.vulnerability.impact:sensitive
information
Show any findings that contain "sensitive" or "information" in consequence
vulnerabilities.vulnerability.impact:"sensitive
information"
Show any findings that match exact value "sensitive information"
vulnerabilities.vulnerability.impact:'sensitive
information'
vulnerabilities.vulnerability.cveIdsvulnerabilities.vulnerability.cveIds
Example
Show findings with CVE name CVE-2015-0313
vulnerabilities.vulnerability.cveIds:CVE-2015-0313
Example
Show assets with this score
vulnerabilities.vulnerability.cvss3_1Info.temporalScore:6.4
Example
Show assets with this score
vulnerabilities.vulnerability.cvss3_1Info.baseScore:7.8
Example
Show findings with this name
vulnerabilities.vulnerability.cvss2Info.accessVector:NETWORK
vulnerabilities.vulnerability.cvss2Info.baseScorevulnerabilities.vulnerability.cvss2Info.baseScore
Example
Show assets with this score
vulnerabilities.vulnerability.cvss2Info.baseScore:7.8
Example
Show assets with this score
vulnerabilities.vulnerability.cvss2Info.temporalScore:6.4
vulnerabilities.vulnerability.discoveryTypesvulnerabilities.vulnerability.discoveryTypes
Example
Show findings with Remote discovery type
vulnerabilities.vulnerability.discoveryTypes:REMOTE
vulnerabilities.vulnerability.flagsvulnerabilities.vulnerability.flags
Example
Show findings with this flag
vulnerabilities.vulnerability.flags:PCI_RELATED
vulnerabilities.vulnerability.osvulnerabilities.vulnerability.os
Examples
Show any findings related to this OS value
vulnerabilities.vulnerability.os:windows
Show any findings that contain parts of OS value
vulnerabilities.vulnerability.os:"windows"
Show any findings that match exact value "windows"
vulnerabilities.vulnerability.os:`windows`
vulnerabilities.vulnerability.patchAvailablevulnerabilities.vulnerability.patchAvailable
Examples
Show findings with patch available
vulnerabilities.vulnerability.patchAvailable:TRUE
Show findings with no patch available
vulnerabilities.vulnerability.patchAvailable:FALSE
vulnerabilities.vulnerability.pcivulnerabilities.vulnerability.pci
Examples
Show PCI vulnerabilities
vulnerabilities.vulnerability.pci:TRUE
Do not show PCI vulnerabilities
vulnerabilities.vulnerability.pci:FALSE
vulnerabilities.vulnerability.rebootRequiredvulnerabilities.vulnerability.rebootRequired
Examples
Show vulnerabilities that need reboot.
vulnerabilities.vulnerability.rebootRequired: TRUE
vulnerabilities.vulnerability.qidvulnerabilities.vulnerability.qid
Example
Show findings with QID 90405
vulnerabilities.vulnerability.qid: 90405
vulnerabilities.vulnerability.sans20Categoriesvulnerabilities.vulnerability.sans20Categories
Example
Show findings with this category name
vulnerabilities.vulnerability.sans20Categories:Media
Players
vulnerabilities.vulnerability.solutionvulnerabilities.vulnerability.solution
Examples
Show any findings related to this solution
vulnerabilities.vulnerability.solution:Bulletin
MS10-006
Show any findings that contain parts of solution
vulnerabilities.vulnerability.solution:"Bulletin
MS10-006"
Show any findings that match exact value "Bulletin MS10-006"
vulnerabilities.vulnerability.solution:`Bulletin
MS10-006`
vulnerabilities.vulnerability.supportedByvulnerabilities.vulnerability.supportedBy
Example
Show vulnerabilities supported by Linux Agent
vulnerabilities.vulnerability.supportedBy:LINUX_AGENT
vulnerabilities.vulnerability.titlevulnerabilities.vulnerability.title
Examples
Show any findings related to this title
vulnerabilities.vulnerability.title:Remote Code
Execution
Show any findings that contain "Remote" or "Code" in title
vulnerabilities.vulnerability.title:"Remote
Code"
Show any findings that match exact value "Remote Code"
vulnerabilities.vulnerability.title:`Remote Code`
vulnerabilities.vulnerability.vendorRefsvulnerabilities.vulnerability.vendorRefs
Example
Show this vendor reference
vulnerabilities.vulnerability.vendorRefs:KB3021953
vulnerabilities.vulnerability.vendors.productNamevulnerabilities.vulnerability.vendors.productName
Example
Show findings with this vendor product name
vulnerabilities.vulnerability.vendors.productName:Windows
vulnerabilities.vulnerability.vendors.vendorNamevulnerabilities.vulnerability.vendors.vendorName
Example
Show findings with this vendor name
vulnerabilities.vulnerability.vendors.vendorName:Adobe
vulnerabilities.nonExploitableKernelvulnerabilities.nonExploitableKernel
Examples
Show findings on non-exploitable kernels
vulnerabilities.nonExploitableKernel:TRUE
vulnerabilities.nonExploitableServicevulnerabilities.nonExploitableService
Examples
Show findings on non-exploitable services
vulnerabilities.nonExploitableService:TRUE
vulnerabilities.vulnerability.patchReleasedvulnerabilities.vulnerability.patchReleased
Examples
Show findings last found within certain dates
vulnerabilities.vulnerability.patchReleased:[2018-10-21
... 2019-01-15]
Show findings last found starting 2020-01-01, ending 1 month ago
vulnerabilities.vulnerability.patchReleased:[2020-01-01
... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.patchReleased:[now-2w
... now-1s]
Show findings last found on certain date
vulnerabilities.vulnerability.patchReleased:'2020-01-02'
vulnerabilities.timesFoundvulnerabilities.timesFound
Examples
Show findings last found 3 times
vulnerabilities.timesFound:3
vulnerabilities.vulnerability.kbAgevulnerabilities.vulnerability.kbAge
Example
Show findings that were disclosed in the last 30 days
vulnerabilities.vulnerability.kbAge:[00..30]
vulnerabilities.detectionAgevulnerabilities.detectionAge
Example
Show findings that were detected in the last 30 days.
vulnerabilities.detectionAge:[00..30]
vulnerabilities.vulnerability.descriptionvulnerabilities.vulnerability.description
Examples
Show any findings related to description
vulnerabilities.vulnerability.description:remote
code execution
Show any findings that contain "remote" or "code" in description
vulnerabilities.vulnerability.description:"remote
code execution"
Show any findings that match exact value "remote code execution"
vulnerabilities.vulnerability.description:`remote
code execution`
vulnerabilities.vulnerability.listsvulnerabilities.vulnerability.lists
Example
Show findings with vulnerabilities in SANS Top 20
vulnerabilities.vulnerability.lists:SANS_20
vulnerabilities.vulnerability.publishedvulnerabilities.vulnerability.published
Examples
Show findings for vulnerabilities published within certain dates
vulnerabilities.vulnerability.published:[2015-10-21
... 2016-01-15]
Show findings for vulnerabilities published starting 2017-01-01, ending 1 month ago
vulnerabilities.vulnerability.published:[2017-01-01
... now-1M]
Show findings for vulnerabilities published starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.published:[now-2w
... now-1s]
Show findings for vulnerabilities published on certain date
vulnerabilities.vulnerability.published:'2018-01-15'
vulnerabilities.vulnerability.ransomware.namevulnerabilities.vulnerability.ransomware.name
Example
Show findings with this name
vulnerabilities.vulnerability.ransomware.name: Locky
Show findings that match exact value
vulnerabilities.vulnerability.ransomware.name: Locky
vulnerabilities.vulnerability.riskvulnerabilities.vulnerability.risk
Example
Show findings with risk 50
vulnerabilities.vulnerability.risk:50
vulnerabilities.vulnerability.qualysPatchablevulnerabilities.vulnerability.qualysPatchable
Examples
Show vulnerabilities with patch available at Qualys
vulnerabilities.vulnerability.qualysPatchable: "true"
Show vulnerabilities with patch not available at Qualys
vulnerabilities.vulnerability.qualysPatchable: "false"
vulnerabilities.vulnerability.criticalityvulnerabilities.vulnerability.criticality
Examples
Show vulnerabilities with HIGH criticality
vulnerabilities.vulnerability.criticality: "HIGH"
vulnerabilities.vulnerability.updatedvulnerabilities.vulnerability.updated
Examples
Show vulnerabilities updated within certain dates
vulnerabilities.vulnerability.updated:[2017-10-21
... 2017-10-30]
Show vulnerabilities updated starting 2017-11-01, ending 1 month ago
vulnerabilities.vulnerability.updated:[2017-11-01
... now-1M]
Show vulnerabilities updated stating 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.updated:[now-2w
... now-1s]
Show vulnerabilities updated on certain date
vulnerabilities.vulnerability.updated:'2018-03-08'
Use the text value within quotes or backticks for the tactics id that represents the why of the ATT&CK technique or sub-technique.
Example
Show findings with the Tactic ID TA0007
vulnerabilities.vulnerability.mitre.attack.tactic.id:`TA0007`
Use the text value within quotes or backticks to view for the tactics name that represents it's respective tactic id.
Example
Show findings with the tactic name inital-access
vulnerabilities.vulnerability.mitre.attack.tactic.name:`inital-access`
Use the text value within quotes or backticks for the technique id that represents how a tactical goal can be achieved.
Example
Show findings with the Technique ID T1562.010
vulnerabilities.vulnerability.mitre.attack.technique.id:"T1562.010"
Use the text value within quotes or backticks to view for the technique name that represents it's respective technique id.
Example
Show findings with the tactic name Downgrade Attack
vulnerabilities.vulnerability.mitre.attack.technique.name:"Downgrade Attack"
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Use these tokens for searching Real-Time Threat Indicator (RTI) related vulnerabilities. You must have a subscription to the Threat Protection app to use these tokens.
Examples
Show assets with threats due to active attacks
vulnerabilities.vulnerability.threatIntel.activeAttacks:
true
Show assets that don't have threats due to active attacks
vulnerabilities.vulnerability.threatIntel.activeAttacks:
false
Examples
Show assets with threats due to CISA exploit
vulnerabilities.vulnerability.threatIntel.cisaKnownExploitedVulns:
true
Show assets that don't have threats due to CISA exploit
vulnerabilities.vulnerability.threatIntel.cisaKnownExploitedVulns:
false
Examples
Show assets with threats due to denial of service
vulnerabilities.vulnerability.threatIntel.denialOfService:
true
Show assets that don't have threats due to denial of service
vulnerabilities.vulnerability.threatIntel.denialOfService:
false
Examples
Show assets with threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.easyExploit:
true
Show assets that don't have threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.easyExploit:
false
Examples
Show assets with threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit:
true
Show assets that don't have threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit:
false
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.exploitKitName:
Angler
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.exploitKitName:
`Angler`
Examples
Show assets with threats due to high data loss
vulnerabilities.vulnerability.threatIntel.highDataLoss:
true
Show assets that don't have threats due to high data loss
vulnerabilities.vulnerability.threatIntel.highDataLoss:
false
Examples
Show assets with threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.highLateralMovement:
true
Show assets that don't have threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.highLateralMovement:
false
vulnerabilities.vulnerability.threatIntel.malwarevulnerabilities.vulnerability.threatIntel.malware
Examples
Show assets with threats due to malware
vulnerabilities.vulnerability.threatIntel.malware: true
Show assets that don't have threats due to malware
vulnerabilities.vulnerability.threatIntel.malware: false
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.malwareName:
TROJ_PDFKA.DQ
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.malwareName:
`TROJ_PDFKA.DQ`
vulnerabilities.vulnerability.threatIntel.noPatchvulnerabilities.vulnerability.threatIntel.noPatch
Examples
Show assets with threats due to no patch available
vulnerabilities.vulnerability.threatIntel.noPatch: true
Show assets that don't have threats due to no patch available
vulnerabilities.vulnerability.threatIntel.noPatch: false
Example
Show assets with threats due to public exploit
vulnerabilities.vulnerability.threatIntel.publicExploit:
true
Show assets that don't have threats due to public exploit
vulnerabilities.vulnerability.threatIntel.publicExploit:
false
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.publicExploitName:
RealVNC NULL Authentication Mode Bypass
Show any findings that contain parts of name
vulnerabilities.vulnerability.threatIntel.publicExploitName:
"RealVNC NULL Authentication Mode Bypass"
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.publicExploitName:
`RealVNC NULL Authentication Mode Bypass`
vulnerabilities.vulnerability.threatIntel.zeroDayvulnerabilities.vulnerability.threatIntel.zeroDay
Examples
Show assets with threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.zeroDay: true
Show assets that don't have threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.zeroDay: false
vulnerabilities.vulnerability.threatIntel.wormablevulnerabilities.vulnerability.threatIntel.wormable
Examples
Show assets with wormable threats
vulnerabilities.vulnerability.threatIntel.wormable: "true"
Examples
Show assets with predicted high risk threat
vulnerabilities.vulnerability.threatIntel.predictedHighRisk:
"true"
Examples
Show assets with unauthenticated exploitation threat
vulnerabilities.vulnerability.threatIntel.unauthenticatedExploitation:
"true"
Examples
Show assets with remote code execution threat
vulnerabilities.vulnerability.threatIntel.remoteCodeExecution:
"true"
Examples
Show assets with ransomeware threat
vulnerabilities.vulnerability.threatIntel.ransomware:
"true"
Examples
Show assets with privilege escalation threat
vulnerabilities.vulnerability.threatIntel.privilegeEscalation:
"true"
Examples
Show assets with Solorigate/Sunburst threat
vulnerabilities.vulnerability.threatIntel.solorigateSunburst:
"true"