Using Vulnerability and Patches Tokens in Combination to Create Linux Job
Use the vulnerability and patch tokens in combination to define criteria to create a QQL-based Linux job. Looking for help with writing your query? click here
Patches Tokens
Use a text value ##### to find patches applied to a certain advisory.
Example
Find patches for RHSA-2015:2241
patch.advisory: "RHSA-2015:2241"
patch.architecturepatch.architecture
Use a text value ##### to find patches applied to a certain architecture (x86, x64).
Example
Find patches for x64
patch.architecture: x64
Use a text value ##### to find patches of certain category (Security, Software Distribution, Security Tools, Non-security Patches, Custom Actions).
Example
Show patches of category Security
patch.category: `Security`
Use a text value ##### to find patches by certain CVE ID.
Example
Find patches for this CVE ID
patch.cveId: CVE-208-0760
patch.isSecuritypatch.isSecurity
Use the values true | false to find patches of type Security.
Example
Show security patches
patch.isSecurity: true
patch.updatedDatepatch.updatedDate
Use a date range or specific date to find when patches were last modified.
Examples
Show patches modified within certain dates
patch.updatedDate: [2018-02-01 ... 2018-02-12]
Show patches modified starting 2018-02-01, ending 1 month ago
patch.updatedDate: [2018-02-01 ... now-1M]
Show patches modified starting 2 weeks ago, ending 1 second ago
patch.updatedDate: [now-2w ... now-1s]
Show patches modified on certain date
patch.updatedDate:'2018-02-22'
Use a text value ##### to find patches by patch ID.
Example
Find patches with this ID
patch.id: 8fc0797d-2c7b-3c08-8e7b-48c30585a702
patch.publishedDatepatch.publishedDate
Use a date range or specific date to find when patches were last published.
Examples
Show patches published within certain dates
patch.publishedDate: [2018-02-01 ... 2018-02-12]
Show patches published starting 2018-02-01, ending 1 month ago
patch.publishedDate: [2018-02-01 ... now-1M]
Show patches published starting 2 weeks ago, ending 1 second ago
patch.publishedDate: [now-2w ... now-1s]
Show patches published on certain date
patch.publishedDate:'2018-02-22'
Use a text value ##### to find patches by certain QID.
Example
Find patches for this QID
patch.qid: 3015321
patch.isRebootRequiredpatch.isRebootRequired
Use the values true | false to find patches that require reboot.
Example
Show patches where reboot is required
patch.isRebootRequired: true
patch.supportedOspatch.supportedOs
Use a text value ##### to find patches applied to a certain OS.
Example
Find patches for Redhat
patch.supportedOs: Redhat
patch.vendorSeveritypatch.vendorSeverity
Use a text value ##### to find patches with certain vendor assigned severity level (Critical, Important, Moderate, Low, None).
Example
Find patches with this vendor assigned severity level
patch.vendorSeverity: Critical
Use values within quotes or backticks to find patches with certain title.
Examples
Find patches related to title
patch.title: Security
Find patches that contain parts of title
patch.title: "Security and Quality Rollup for the .Net Framework"
Find patches that match exact value
patch.title: `Security for the .Net Framework`
patch.isRollbackpatch.isRollback
Use the values true | false to find patches that can be rolled back.
Example
Show patches eligible for rollback.
patch.isRollback: true
patch.qualysPublishedDatepatch.qualysPublishedDate
Use a date range or specific date to find when patches were published in Qualys Patch Management
Examples
Show patches published in Qualys Patch Management within certain dates
patch.qualysPublishedDate: [2018-02-01 ... 2018-02-12]
Show patches published in Qualys Patch Management starting 2018-02-01, ending 1 month ago
patch.qualysPublishedDate: [2018-02-01 ... now-1M]
Show patches published in Qualys Patch Management starting 2 weeks ago, ending 1 second ago
patch.qualysPublishedDate: [now-2w ... now-1s]
Show patches published in Qualys Patch Management on certain date
patch.qualysPublishedDate:'2018-02-22'
Vulnerabilities Tokens
Use these tokens to define search criteria for vulnerabilities. You must have a subscription to VMDR app to use these tokens.
vulnerabilities.firstFoundvulnerabilities.firstFound
Use a date range or specific date to define when findings were first found.
Examples
Show findings first found within certain dates
vulnerabilities.firstFound:[2017-10-21 ... 2017-10-30]
Show findings first found starting 2015-10-01, ending 1 month ago
vulnerabilities.firstFound:[2015-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
vulnerabilities.firstFound:[now-2w ... now-1s]
Show findings first found on certain date
vulnerabilities.firstFound:'2016-11-11'
vulnerabilities.hostAssetNamevulnerabilities.hostAssetName
Use quotes or backticks within values to help you find the host asset name you're looking for.
Examples
Show any findings related to name
vulnerabilities.hostAssetName:QK2K12QP3-65-53
Show any findings that contain parts of name
vulnerabilities.hostAssetName:"QK2K12QP3-65-53"
Show any findings that match exact value "QK2K12QP3-65-53"
vulnerabilities.hostAssetName:`QK2K12QP3-65-53`
vulnerabilities.hostOSvulnerabilities.hostOS
Use quotes or backticks within values to help you find the host operating system you're interested in.
Examples
Show any findings with this OS name
vulnerabilities.hostOS:Windows 2012
Show any findings that contain components of OS name
vulnerabilities.hostOS:"Windows 2012"
Show any findings that match exact value "Windows 2012"
vulnerabilities.hostOS:`Windows 2012`
vulnerabilities.foundvulnerabilities.found
Use the values true | false to define vulnerabilities are detected or not on the assets.
Examples
Show findings with vulnerabilities detected
vulnerabilities.found:TRUE
vulnerabilities.detectionScorevulnerabilities.detectionScore
Use an integer value (0-100) to help you find vulnerabilities based on specific detection score.
Examples
Show vulnerabilities with detection score 80
vulnerabilities.detectionScore:80
Show vulnerabilities with detection score 25
vulnerabilities.detectionScore:25
vulnerabilities.disabledvulnerabilities.disabled
Use the values true | false to define vulnerabilities are disabled or enabled.
Examples
Show findings with vulnerabilities disabled
vulnerabilities.disabled:TRUE
vulnerabilities.lastFixedvulnerabilities.lastFixed
Use a date range or specific date to define when findings were last fixed.
Examples
Show findings last fixed within certain dates
vulnerabilities.lastFixed:[2015-10-21 ... 2016-01-15]
Show findings last fixed starting 2016-01-01, ending 1 month ago
vulnerabilities.lastFixed:[2016-01-01 ... now-1M]
Show findings last fixed starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFixed:[now-2w ... now-1s]
Show findings last fixed on certain date
vulnerabilities.lastFixed:'2016-01-11'
Show findings last fixed within certain number of days
vulnerabilities.lastFixed: [91..180]
vulnerabilities.lastFoundvulnerabilities.lastFound
Use a date range or specific date to define when findings were last found.
Examples
Show findings last found within certain dates
vulnerabilities.lastFound:[2015-10-21 ... 2016-01-15]
Show findings last found starting 2016-01-01, ending 1 month ago
vulnerabilities.lastFound:[2016-01-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFound:[now-2w ... now-1s]
Show findings last found on certain date
vulnerabilities.lastFound:'2016-01-11'
Show findings last found within certain number of days
vulnerabilities.lastFound: [91..180]
Show findings last found on 2017-01-12 with patch available
vulnerabilities: (lastFound:'2017-01-12' AND vulnerability.patchAvailable:TRUE)
vulnerabilities: (lastFound: AND vulnerability.patchAvailable:TRUE)
vulnerabilities.nonExploitableConfigvulnerabilities.nonExploitableConfig
Use the values true | false to define vulnerabilities with non-exploitable configurations.
Examples
Show findings with non exploitable configurations
vulnerabilities.nonExploitableConfig:TRUE
Show findings with exploitable configurations
vulnerabilities.nonExploitableConfig:FALSE
vulnerabilities.nonRunningKernelvulnerabilities.nonRunningKernel
Use the values true | false to view vulnerabilities found on non-running kernels.
Examples
Show detections found on non-running Kernel
vulnerabilities.nonRunningKernel:TRUE
Show detections found on running Kernel
vulnerabilities.nonRunningKernel:FALSE
vulnerabilities.sslvulnerabilities.ssl
Use the values true | false to define vulnerabilities found on secure socket layer (SSL).
Examples
Show vulnerabilities associated with SSL
vulnerabilities.ssl:TRUE
vulnerabilities.portvulnerabilities.port
Use an integer value ##### to help you find vulnerabilities found on a certain port.
Example
Show vulnerabilities found on this port
vulnerabilities.port:443
vulnerabilities.protocolvulnerabilities.protocol
Use a text value ##### (UDP or TCP) to define the port protocol you're interested in.
Example
Show vulnerabilities found on TCP protocol
vulnerabilities.protocol:TCP
vulnerabilities.ignoredvulnerabilities.ignored
Use an integer value ##### to help you find vulnerabilities that have been marked as ignored.
Example
Show vulnerabilities that are marked as ignored
vulnerabilities.ignored:TRUE
vulnerabilities.instancevulnerabilities.instance
Use an integer value ##### to help you find vulnerabilities found on a certain instance.
Example
Show vulnerabilities found on this instance
vulnerabilities.instance: 354216
vulnerabilities.severityvulnerabilities.severity
Select a severity (1-5) to find assets having vulnerabilities with this severity. Select from values in the drop-down menu.
Example
Show findings with severity 5
vulnerabilities.severity:5
vulnerabilities.statusvulnerabilities.status
Select a status (e.g. Active, Fixed, New, Reopened) to find vulnerabilities with certain status. Select from names in the drop-down menu.
If you select the status as Fixed, the list will only show vulnerabilities that are fixed in the last 365 days.
Example
Show vulnerabilities with New status
vulnerabilities.status:NEW
vulnerabilities.typeDetectedvulnerabilities.typeDetected
Select a detection type (e.g. Confirmed, Potential, Information) to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
Example
Show findings with this type
vulnerabilities.typeDetected:Confirmed
vulnerabilities.vulnerability.authTypesvulnerabilities.vulnerability.authTypes
Select the name (WINDOWS_AUTH, UNIX_AUTH, ORACLE_AUTH, etc) of an authentication type you're interested in. Select from names in the drop-down menu.
Example
Show findings with Windows auth type
vulnerabilities.vulnerability.authTypes:WINDOWS_AUTH
vulnerabilities.vulnerability.bugTraqIdsvulnerabilities.vulnerability.bugTraqIds
Use a text value ##### to find a BugTraq number you're interested in.
Example
Show findings with BugTraq ID 22211
vulnerabilities.vulnerability.bugTraqIds:22211
vulnerabilities.vulnerability.categoryvulnerabilities.vulnerability.category
Select a category (CGI, Database, DNS, BIND, etc) to find vulnerabilities with this category. Select from names in the drop-down menu.
Example
Show findings with category CGI
vulnerabilities.vulnerability.category:CGI
Use quotes or backticks within values to help you find the compliance description you're looking for.
Examples
Show any findings related to this description
vulnerabilities.vulnerability.compliance.description:malicious software
Show any findings that contain "malicious" or "software" in description
vulnerabilities.vulnerability.compliance.description:"malicious software"
Show any findings that match exact value "malicious software"
vulnerabilities.vulnerability.compliance.description:`malicious software`
vulnerabilities.vulnerability.compliance.sectionvulnerabilities.vulnerability.compliance.section
Use quotes or backticks within values to help you find the compliance section you're looking for.
Examples
Show any findings related to this section
vulnerabilities.vulnerability.compliance.section:164.308
Show any findings that contain parts of section
vulnerabilities.vulnerability.compliance.section:"164.308"
Show any findings that match exact value "164.308"
vulnerabilities.vulnerability.compliance.section:`164.308`
vulnerabilities.vulnerability.compliance.typevulnerabilities.vulnerability.compliance.type
Select the name ##### of a compliance type you're interested in (e.g. COBIT, HIPAA, GLBA, SOX). Select from names in the drop-down menu.
Example
Show findings with the compliance type HIPAA
vulnerabilities.vulnerability.compliance.type:HIPAA
vulnerabilities.vulnerability.impactvulnerabilities.vulnerability.impact
Use quotes or backticks within values to help you find the impact you're looking for.
Example
Show any findings related to impact
vulnerabilities.vulnerability.impact:sensitive information
Show any findings that contain "sensitive" or "information" in consequence
vulnerabilities.vulnerability.impact:"sensitive information"
Show any findings that match exact value "sensitive information"
vulnerabilities.vulnerability.impact:'sensitive information'
vulnerabilities.vulnerability.cveIdsvulnerabilities.vulnerability.cveIds
Use a text value ##### to find the CVE name you're interested in.
Example
Show findings with CVE name CVE-2015-0313
vulnerabilities.vulnerability.cveIds:CVE-2015-0313
Use an integer value ##### to help you find the CVSSv3 temporal score you're interested in.
Example
Show assets with this score
vulnerabilities.vulnerability.cvss3_1Info.temporalScore:6.4
Use an integer value ##### to help you find the CVSSv3 base score you're interested in.
Example
Show assets with this score
vulnerabilities.vulnerability.cvss3_1Info.baseScore:7.8
Select the name ##### of a CVSS2 access vector you'd like to find (e.g. UNDEFINED, LOCAL_ACCESS, ADJACENT_NETWORK, NETWORK). Select from names in the drop-down menu.
Example
Show findings with this name
vulnerabilities.vulnerability.cvss2Info.accessVector:NETWORK
vulnerabilities.vulnerability.cvss2Info.baseScorevulnerabilities.vulnerability.cvss2Info.baseScore
Use an integer value ##### to help you find the CVSS2 base score you're interested in.
Example
Show assets with this score
vulnerabilities.vulnerability.cvss2Info.baseScore:7.8
Use an integer value ##### to help you find the CVSS2 temporal score you're interested in.
Example
Show assets with this score
vulnerabilities.vulnerability.cvss2Info.temporalScore:6.4
vulnerabilities.vulnerability.discoveryTypesvulnerabilities.vulnerability.discoveryTypes
Select a discovery type (Remote or Authenticated) to find assets with vulnerabilities having this discovery type. Select from names in the drop-down menu.
Example
Show findings with Remote discovery type
vulnerabilities.vulnerability.discoveryTypes:REMOTE
vulnerabilities.vulnerability.flagsvulnerabilities.vulnerability.flags
Use a text value ##### to find the Qualys defined vulnerability property of interest (e.g. REMOTE, WINDOWS_AUTH, UNIX_AUTH, PCI_RELATED etc).
Example
Show findings with this flag
vulnerabilities.vulnerability.flags:PCI_RELATED
vulnerabilities.vulnerability.osvulnerabilities.vulnerability.os
Use quotes or backticks within values to help you find the operating system vulnerabilities were detected on.
Examples
Show any findings related to this OS value
vulnerabilities.vulnerability.os:windows
Show any findings that contain parts of OS value
vulnerabilities.vulnerability.os:"windows"
Show any findings that match exact value "windows"
vulnerabilities.vulnerability.os:`windows`
vulnerabilities.vulnerability.patchAvailablevulnerabilities.vulnerability.patchAvailable
Use the values true | false to define vulnerabilities with patch available.
Examples
Show findings with patch available
vulnerabilities.vulnerability.patchAvailable:TRUE
Show findings with no patch available
vulnerabilities.vulnerability.patchAvailable:FALSE
vulnerabilities.vulnerability.pcivulnerabilities.vulnerability.pci
Use the values true | false to find vulnerabilities that must be fixed for PCI Compliance (per PCI DSS).
Examples
Show PCI vulnerabilities
vulnerabilities.vulnerability.pci:TRUE
Do not show PCI vulnerabilities
vulnerabilities.vulnerability.pci:FALSE
vulnerabilities.vulnerability.rebootRequiredvulnerabilities.vulnerability.rebootRequired
Use the values true | false to find vulnerabilities that need reboot.
Examples
Show vulnerabilities that need reboot.
vulnerabilities.vulnerability.rebootRequired: TRUE
vulnerabilities.vulnerability.qidvulnerabilities.vulnerability.qid
Use an integer value ##### to define the QID in question.
Example
Show findings with QID 90405
vulnerabilities.vulnerability.qid: 90405
vulnerabilities.vulnerability.sans20Categoriesvulnerabilities.vulnerability.sans20Categories
Use a text value ##### to find vulnerabilities in the SANS 20 category you're interested in (e.g. Anti-virus Software, Backup Software, etc).
Example
Show findings with this category name
vulnerabilities.vulnerability.sans20Categories:Media Players
vulnerabilities.vulnerability.solutionvulnerabilities.vulnerability.solution
Use quotes or backticks within values to help you find the solution you're looking for.
Examples
Show any findings related to this solution
vulnerabilities.vulnerability.solution:Bulletin MS10-006
Show any findings that contain parts of solution
vulnerabilities.vulnerability.solution:"Bulletin MS10-006"
Show any findings that match exact value "Bulletin MS10-006"
vulnerabilities.vulnerability.solution:`Bulletin MS10-006`
vulnerabilities.vulnerability.supportedByvulnerabilities.vulnerability.supportedBy
Select a Qualys service (VM, Agent type, etc) to show vulnerabilities that can be detected by this service. Select from names in the drop-down menu.
Example
Show vulnerabilities supported by Linux Agent
vulnerabilities.vulnerability.supportedBy:LINUX_AGENT
vulnerabilities.vulnerability.titlevulnerabilities.vulnerability.title
Use quotes or backticks within values to help you find the title you're looking for.
Examples
Show any findings related to this title
vulnerabilities.vulnerability.title:Remote Code Execution
Show any findings that contain "Remote" or "Code" in title
vulnerabilities.vulnerability.title:"Remote Code"
Show any findings that match exact value "Remote Code"
vulnerabilities.vulnerability.title:`Remote Code`
vulnerabilities.vulnerability.vendorRefsvulnerabilities.vulnerability.vendorRefs
Use a text value ##### to find the vendor reference you're interested in.
Example
Show this vendor reference
vulnerabilities.vulnerability.vendorRefs:KB3021953
vulnerabilities.vulnerability.vendors.productNamevulnerabilities.vulnerability.vendors.productName
Use a text value ##### to find the vendor product name you're interested in.
Example
Show findings with this vendor product name
vulnerabilities.vulnerability.vendors.productName:Windows
vulnerabilities.vulnerability.vendors.vendorNamevulnerabilities.vulnerability.vendors.vendorName
Use a text value ##### to find the vendor name you're interested in.
Example
Show findings with this vendor name
vulnerabilities.vulnerability.vendors.vendorName:Adobe
vulnerabilities.nonExploitableKernelvulnerabilities.nonExploitableKernel
Use the values true | false to define vulnerabilities that exist on non exploitable kernels.
Examples
Show findings on non-exploitable kernels
vulnerabilities.nonExploitableKernel:TRUE
vulnerabilities.nonExploitableServicevulnerabilities.nonExploitableService
`Use the values true | false to define vulnerabilities that exist on non exploitable services.
Examples
Show findings on non-exploitable services
vulnerabilities.nonExploitableService:TRUE
vulnerabilities.vulnerability.patchReleasedvulnerabilities.vulnerability.patchReleased
Use a date range or specific date to define when patch was available.
Examples
Show findings last found within certain dates
vulnerabilities.vulnerability.patchReleased:[2018-10-21 ... 2019-01-15]
Show findings last found starting 2020-01-01, ending 1 month ago
vulnerabilities.vulnerability.patchReleased:[2020-01-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.patchReleased:[now-2w ... now-1s]
Show findings last found on certain date
vulnerabilities.vulnerability.patchReleased:'2020-01-02'
vulnerabilities.timesFoundvulnerabilities.timesFound
Show findings that were detected for the specified number of times.
Examples
Show findings last found 3 times
vulnerabilities.timesFound:3
vulnerabilities.vulnerability.kbAgevulnerabilities.vulnerability.kbAge
Select the number of days from the range (00..30, 31..60, 61..90, 91..180,180..+) since the vulnerability was disclosed. Select the number of days from the drop-down menu.
Example
Show findings that were disclosed in the last 30 days
vulnerabilities.vulnerability.kbAge:[00..30]
vulnerabilities.detectionAgevulnerabilities.detectionAge
Select the number of days from the range (00..30, 31..60, 61..90, 91..180,180..+) since the vulnerability was first detected (by a scanner or cloud agent) on the asset. Select the number of days from the drop-down menu.
Example
Show findings that were detected in the last 30 days.
vulnerabilities.detectionAge:[00..30]
vulnerabilities.vulnerability.descriptionvulnerabilities.vulnerability.description
Use quotes or backticks within values to help you find the vulnerability description you're looking for.
Examples
Show any findings related to description
vulnerabilities.vulnerability.description:remote code execution
Show any findings that contain "remote" or "code" in description
vulnerabilities.vulnerability.description:"remote code execution"
Show any findings that match exact value "remote code execution"
vulnerabilities.vulnerability.description:`remote code execution`
vulnerabilities.vulnerability.listsvulnerabilities.vulnerability.lists
Use a text value ##### to find the vulnerability list of interest (e.g. SANS_20, QUALYS_20, QUALYS_INT_10, QUALYS_EXT_10).
Example
Show findings with vulnerabilities in SANS Top 20
vulnerabilities.vulnerability.lists:SANS_20
vulnerabilities.vulnerability.publishedvulnerabilities.vulnerability.published
Use a date range or specific date to define when vulnerabilities were first published in the KnowledgeBase.
Examples
Show findings for vulnerabilities published within certain dates
vulnerabilities.vulnerability.published:[2015-10-21 ... 2016-01-15]
Show findings for vulnerabilities published starting 2017-01-01, ending 1 month ago
vulnerabilities.vulnerability.published:[2017-01-01 ... now-1M]
Show findings for vulnerabilities published starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.published:[now-2w ... now-1s]
Show findings for vulnerabilities published on certain date
vulnerabilities.vulnerability.published:'2018-01-15'
vulnerabilities.vulnerability.ransomware.namevulnerabilities.vulnerability.ransomware.name
Use quotes or backticks within values to help you find the ransomware name you're looking for. Quotes can be used when the value has more than one word.
Example
Show findings with this name
vulnerabilities.vulnerability.ransomware.name: Locky
Show findings that match exact value
vulnerabilities.vulnerability.ransomware.name: Locky
vulnerabilities.vulnerability.riskvulnerabilities.vulnerability.risk
Use an integer value ##### to define the vulnerability risk rating you're interested in. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
vulnerabilities.vulnerability.risk:50
vulnerabilities.vulnerability.qualysPatchablevulnerabilities.vulnerability.qualysPatchable
Use the values true | false to define that can be patched at Qualys.
Examples
Show vulnerabilities with patch available at Qualys
vulnerabilities.vulnerability.qualysPatchable: "true"
Show vulnerabilities with patch not available at Qualys
vulnerabilities.vulnerability.qualysPatchable: "false"
vulnerabilities.vulnerability.criticalityvulnerabilities.vulnerability.criticality
Select a criticality (e.g. "CRITICAL","HIGH","MEDIUM","LOW","NONE") to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
Examples
Show vulnerabilities with HIGH criticality
vulnerabilities.vulnerability.criticality: "HIGH"
vulnerabilities.vulnerability.updatedvulnerabilities.vulnerability.updated
Use a date range or specific date to define when vulnerabilities were updated in the KnowledgeBase.
Examples
Show vulnerabilities updated within certain dates
vulnerabilities.vulnerability.updated:[2017-10-21 ... 2017-10-30]
Show vulnerabilities updated starting 2017-11-01, ending 1 month ago
vulnerabilities.vulnerability.updated:[2017-11-01 ... now-1M]
Show vulnerabilities updated stating 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.updated:[now-2w ... now-1s]
Show vulnerabilities updated on certain date
vulnerabilities.vulnerability.updated:'2018-03-08'
Use the text value within quotes or backticks for the tactics id that represents the why of the ATT&CK technique or sub-technique.
Example
Show findings with the Tactic ID TA0007
vulnerabilities.vulnerability.mitre.attack.tactic.id:`TA0007`
Use the text value within quotes or backticks to view for the tactics name that represents its respective tactic id.
Example
Show findings with the tactic name initial-access
vulnerabilities.vulnerability.mitre.attack.tactic.name:`initial-access`
Use the text value within quotes or backticks for the technique id that represents how a tactical goal can be achieved.
Example
Show findings with the Technique ID T1562.010
vulnerabilities.vulnerability.mitre.attack.technique.id:"T1562.010"
Use the text value within quotes or backticks to view for the technique name that represents its respective technique id.
Example
Show findings with the tactic name Downgrade Attack
vulnerabilities.vulnerability.mitre.attack.technique.name:"Downgrade Attack"
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
Type your dropdown text here
RTIs
Use these tokens for searching Real-Time Threat Indicator (RTI) related vulnerabilities. You must have a subscription to the Threat Protection app to use these tokens.
Use the values true | false to define real-time threats due to active attacks.
Examples
Show assets with threats due to active attacks
vulnerabilities.vulnerability.threatIntel.activeAttacks:
true
Show assets that don't have threats due to active attacks
vulnerabilities.vulnerability.threatIntel.activeAttacks:
false
Use the values true | false to define real-time threats due to CISA Exploits.
Examples
Show assets with threats due to CISA exploit
vulnerabilities.vulnerability.threatIntel.cisaKnownExploitedVulns:
true
Show assets that don't have threats due to CISA exploit
vulnerabilities.vulnerability.threatIntel.cisaKnownExploitedVulns:
false
Use the values true | false to define real-time threats due to denial of service.
Examples
Show assets with threats due to denial of service
vulnerabilities.vulnerability.threatIntel.denialOfService:
true
Show assets that don't have threats due to denial of service
vulnerabilities.vulnerability.threatIntel.denialOfService:
false
Use the values true | false to define real-time threats due to easy exploit.
Examples
Show assets with threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.easyExploit:
true
Show assets that don't have threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.easyExploit:
false
Use the values true | false to define real-time threats due to exploit kit.
Examples
Show assets with threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit:
true
Show assets that don't have threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit:
false
Use quotes or backticks within values to help you find the exploit kit name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.exploitKitName:
Angler
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.exploitKitName:
`Angler`
Use the values true | false to define real-time threats due to high data loss.
Examples
Show assets with threats due to high data loss
vulnerabilities.vulnerability.threatIntel.highDataLoss:
true
Show assets that don't have threats due to high data loss
vulnerabilities.vulnerability.threatIntel.highDataLoss:
false
Use the values true | false to define real-time threats due to high lateral movement.
Examples
Show assets with threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.highLateralMovement:
true
Show assets that don't have threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.highLateralMovement:
false
vulnerabilities.vulnerability.threatIntel.malwarevulnerabilities.vulnerability.threatIntel.malware
Use the values true | false to define real-time threats due to malware.
Examples
Show assets with threats due to malware
vulnerabilities.vulnerability.threatIntel.malware: true
Show assets that don't have threats due to malware
vulnerabilities.vulnerability.threatIntel.malware: false
Use quotes or backticks within values to help you find the malware name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.malwareName:
TROJ_PDFKA.DQ
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.malwareName:
`TROJ_PDFKA.DQ`
vulnerabilities.vulnerability.threatIntel.noPatchvulnerabilities.vulnerability.threatIntel.noPatch
Use the values true | false to define real-time threats due to no patch available.
Examples
Show assets with threats due to no patch available
vulnerabilities.vulnerability.threatIntel.noPatch: true
Show assets that don't have threats due to no patch available
vulnerabilities.vulnerability.threatIntel.noPatch: false
Use the values true | false to define real-time threats due to public exploit.
Example
Show assets with threats due to public exploit
vulnerabilities.vulnerability.threatIntel.publicExploit:
true
Show assets that don't have threats due to public exploit
vulnerabilities.vulnerability.threatIntel.publicExploit:
false
Use quotes or backticks within values to help you find the public exploit name of interest. Quotes can be used when the value has more than one word.
Examples
Show any findings with this name
vulnerabilities.vulnerability.threatIntel.publicExploitName:
RealVNC NULL Authentication Mode Bypass
Show any findings that contain parts of name
vulnerabilities.vulnerability.threatIntel.publicExploitName:
"RealVNC NULL Authentication Mode Bypass"
Show any findings that match exact value
vulnerabilities.vulnerability.threatIntel.publicExploitName:
`RealVNC NULL Authentication Mode Bypass`
vulnerabilities.vulnerability.threatIntel.zeroDayvulnerabilities.vulnerability.threatIntel.zeroDay
Use the values true | false to define real-time threats due to zero day exploit.
Examples
Show assets with threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.zeroDay: true
Show assets that don't have threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.zeroDay: false
vulnerabilities.vulnerability.threatIntel.wormablevulnerabilities.vulnerability.threatIntel.wormable
Use the values true | false to define real-time wormable threats.
Examples
Show assets with wormable threats
vulnerabilities.vulnerability.threatIntel.wormable: "true"
Use the values true | false to define real-time threats due to predicted high risk.
Examples
Show assets with predicted high risk threat
vulnerabilities.vulnerability.threatIntel.predictedHighRisk:
"true"
Use the values true | false to define real-time threats due to unauthenticated exploitation risk.
Examples
Show assets with unauthenticated exploitation threat
vulnerabilities.vulnerability.threatIntel.unauthenticatedExploitation:
"true"
Use the values true | false to define real-time threats due to remote code execution risk.
Examples
Show assets with remote code execution threat
vulnerabilities.vulnerability.threatIntel.remoteCodeExecution:
"true"
Use the values true | false to define real-time threats due to ransomware vulnerability.
Examples
Show assets with ransomware threat
vulnerabilities.vulnerability.threatIntel.ransomware:
"true"
Use the values true | false to define real-time threats due to privilege escalation risk.
Examples
Show assets with privilege escalation threat
vulnerabilities.vulnerability.threatIntel.privilegeEscalation:
"true"
Use the values true | false to filter real-time threats due to Solorigate/Sunburst risk.
Examples
Show assets with Solorigate/Sunburst threat
vulnerabilities.vulnerability.threatIntel.solorigateSunburst:
"true"
Finding Tokens
Use these tokens to define search criteria for vulnerabilities.
finding.isDisabledfinding.isDisabled
Use the values true or false to define whether vulnerabilities are disabled or enabled.
Example
Show findings with vulnerabilities disabled
finding.isDisabled:TRUE
Use an integer value (0-100) to help you find vulnerabilities based on specific detection score.
Examples
- Show vulnerabilities with detection score 80
finding.qds:80 - Show vulnerabilities with detection score 25
finding.qds:25
finding.detectionSource.namefinding.detectionSource.name
Use quotes or backticks within values to filter findings by the source that detected the vulnerability. Understanding the detection source is essential to grasp the context, reliability, and scope of the vulnerability.
Examples
- Show findings with Azure Instance Scan as the detection source
finding.detectionSource.name:AZURE_INTERNAL - Show findings that contain part of the detection source name “CAR Agent”
finding.detectionSource.name:"CAR Agent" - Show findings that match the exact value Qualys Agent
finding.detectionSource.name:`QUALYS_AGENT` - Show findings from GCP Instance Scan
finding.detectionSource.name:GCP_INSTANCE_SCAN - Show findings from Agent Remote Scan
finding.detectionSource.name:AGENT_REMOTE_SCAN
To use this token, contact your technical account manager.
finding.detectionSource.firstFoundDatefinding.detectionSource.firstFoundDate
Use a date range or specific date to define when a vulnerability was first detected. Tracking this information helps teams analyze vulnerabilities, prioritize remediation, and identify trends. You can determine if further investigation or alternative remediation is needed by tracking the last and first found dates.
Examples
- Show vulnerabilities first detected on a certain date
finding.detectionSource.firstFoundDate:[2017-10-21 ... 2017-10-30] - Show vulnerabilities first detected starting 2015-10-01, ending 1 month ago
finding.detectionSource.firstFoundDate:[2015-10-01 ... now-1M] - Show vulnerabilities first detected 2 weeks ago, ending 1 second ago
finding.detectionSource.firstFoundDate:[now-2w ... now-1s] - Show vulnerabilities first detected on certain date
finding.detectionSource.firstFoundDate:'2016-11-11'
To use this token, contact your technical account manager.
finding.detectionSource.lastFoundDatefinding.detectionSource.lastFoundDate
Use a date range or specific date to define when a vulnerability was last detected. This helps assess whether a vulnerability is active or has reappeared after remediation. You can determine if further investigation or alternative remediation is needed by tracking the last and first found dates.
Examples
- Show vulnerabilities last detected on a certain date
finding.detectionSource.lastFoundDate:[2017-10-21 ... 2017-10-30] - Show vulnerabilities last detected starting 2015-10-01, ending 1 month ago
finding.detectionSource.lastFoundDate:[2015-10-01 ... now-1M] - Show vulnerabilities last detected 2 weeks ago, ending 1 second ago
finding.detectionSource.lastFoundDate:[now-2w ... now-1s] - Show vulnerabilities last detected on certain date
finding.detectionSource.lastFoundDate:'2016-11-11'
To use this token, contact your technical account manager.
finding.isFoundfinding.isFound
Use the date range or specific date to define when findings were first found.
Examples
- Show findings first found within certain dates
finding.isFound:[2017-10-21 ... 2017-10-30] - Show findings first found starting 2015-10-01, ending 1 month ago
finding.isFound[2015-10-01 ... now-1M] - Show findings first found starting 2 weeks ago, ending 1 second ago
finding.isFound:[now-2w ... now-1s] - Show findings first found on certain date
finding.isFound:'2016-11-11'
finding.host.asset.namefinding.host.asset.name
Use quotes or backticks within values to help you find the host asset name.
Examples
- Show any findings related to name
finding.host.asset.name:QK2K12QP3-65-53 - Show any findings that contain parts of name
finding.host.asset.name"QK2K12QP3-65-53" - Show any findings that match exact value "QK2K12QP3-65-53"
finding.host.asset.name:`QK2K12QP3-65-53`
finding.isIgnoredfinding.isIgnored
Use an integer value to find vulnerabilities that have been marked as ignored.
Example
Show vulnerabilities that are marked as ignored
finding.isIgnored:TRUE
finding.instancefinding.instance
Use a text value to find vulnerabilities found on a certain instance.
Example
Show vulnerabilities found in this instance
finding.instance: oracle
finding.lastFixedDatefinding.lastFixedDate
Use a date range or specific date to define when findings were last fixed.
Examples
- Show findings last fixed within certain dates
finding.lastFixedDate:[2015-10-21 ... 2016-01-15] - Show findings last fixed starting 2016-01-01, ending 1 month ago
finding.lastFixedDate:[2016-01-01 ... now-1M] - Show findings last fixed starting 2 weeks ago, ending 1 second ago
finding.lastFixedDate:[now-2w ... now-1s] - Show findings last fixed on certain date
finding.lastFixedDate:'2016-01-11' - Show findings last fixed within certain number of days
finding.lastFixedDate: [91..180]
finding.lastFoundDatefinding.lastFoundDate
Use a date range or specific date to define when findings were last found.
Examples
- Show findings last found within certain dates
finding.lastFoundDate:[2015-10-21 ... 2016-01-15] - Show findings last found starting 2016-01-01, ending 1 month ago
finding.lastFoundDate:[2016-01-01 ... now-1M] - Show findings last found starting 2 weeks ago, ending 1 second ago
finding.lastFoundDate:[now-2w ... now-1s] - Show findings last found on certain date
finding.lastFoundDate:'2016-01-11' - Show findings last found within certain number of days
finding.lastFoundDate: [91..180] - Show findings last found on 2017-01-12 with patch available
asset.vulnerabilities.count: (lastFound:'2017-01-12' AND finding.vulnerability.isPatchAvailable:TRUE)
finding.nonExploitableConfigfinding.nonExploitableConfig
Use the values true or false to define vulnerabilities with non-exploitable configurations.
Examples
- Show findings with non exploitable configurations
finding.nonExploitableConfig:TRUE - Show findings with exploitable configurations
finding.nonExploitableConfig:FALSE
finding.nonRunningKernelfinding.nonRunningKernel
Use the values true or false to view vulnerabilities found on non-running kernels.
Examples
- Show detections found on non-running Kernel
finding.nonRunningKernel:TRUE - Show detections found on running Kernel
finding.nonRunningKernel:FALSE
Use an integer value to find vulnerabilities found on a certain port.
Example
Show vulnerabilities found on this port
finding.port:443
finding.protocolfinding.protocol
Use a text value UDP or TCP to define the port protocol.
Example
Show vulnerabilities found on TCP protocol
finding.protocol:TCP
finding.riskFactor.cisaKEVDueDatefinding.riskFactor.cisaKEVDueDate
Use a specific date to get the list of known exploited vulnerabilities whose remediation due date is as per the CISA Catalog. The date format used is yyyy-mm-dd.
Example
List the QIDs whose CISA Due Date is 3rd May 2022
finding.riskFactor.cisaKEVDueDate:2022-05-03
finding.riskFactor.isCisaKnownExploitfinding.riskFactor.isCisaKnownExploit
Use this token to get the list of QIDs impacted due to CISA Known Exploits. The token uses true or false as the input value.
Example
List the QIDs that are impacted due to CISA Known Exploit
finding.riskFactor.isCisaKnownExploit:TRUE
finding.riskFactor.threatActorNamefinding.riskFactor.threatActorName
Use a string as an input value to get the list of QIDs that are impacted by the threat actor.
Example
- List the QIDs that are impacted by the threat actor name Labyrinth Chollima
finding.riskFactor.threatActorName:"Labyrinth Chollima" - List the QIDs that are impacted by the threat actor name Insiders
finding.riskFactor.threatActorName:"Insiders" - List the QIDs that are impacted by the threat actor name Sensitive Information
finding.riskFactor.threatActorName:"sensitive information" - List the QIDs that are impacted by the threat actor name Script Kiddies
finding.riskFactor.threatActorName:"Script kiddies"
finding.riskFactor.malwareNamefinding.riskFactor.malwareName
Use a string as an input value to get the list of QIDs that are impacted by the malware name.
Example
List the QIDs that are impacted by the malware name TROJ_PDFKA.DQ
finding.riskFactor.malwareName:"TROJ_PDFKA.DQ"
finding.riskFactor.exploitCodeMaturityfinding.riskFactor.exploitCodeMaturity
Use this token to get the list of QIDs that can be exploited based on the existing state of exploit techniques and code availability.
From the drop-down, select the name of an exploit technique:
poc, weaponized
Example
List the QIDs exploited by Weaponized exploit code maturity technique
finding.riskFactor.exploitCodeMaturity:"weaponized"
finding.riskFactor.exploitTypefinding.riskFactor.exploitType
Use a string as an input value to get the list of QIDs based on the type of exploits and its related vulnerabilities.
Example
List the QIDs that are exploited whose target vulnerabilities are in web applications
finding.riskFactor.exploitType:"webapps"
finding.riskFactor.exploitType:"shellcode"
finding.riskFactor.exploitType:"remote"
finding.riskFactor.rtifinding.riskFactor.rti
Use this token to get the list of QIDs with Real-Time Threat Indicators (RTI) related vulnerabilities.
Example
List the QIDs that are associated with the Denial of Service Real-Time Threat Indicator
finding.riskFactor.rti:"Denial_of_Service"
finding.riskFactor.trendingfinding.riskFactor.trending
Use this token to get the list of QIDs that are trending within a specific date range. You can select the date range from the drop-down.
Example
Show trending vulnerabilities with its QIDs within certain number of days
finding.riskFactor.trending:[16..30]
Use the values true or false to define vulnerabilities found on secure socket layer (SSL).
Example
Show vulnerabilities associated with SSL
finding.ssl:TRUE
finding.severityfinding.severity
Use an integer value to view the severity level set by you to find assets having vulnerabilities. The severity level ranges between 1-5. Select from values in the drop-down menu. If you do not set the severity level, its level will be the same as the level set by Qualys.
Example
Show findings with severity by 5
finding.severity:5
For information about customer and Qualys severity, see Customer and Kb Severity Level
From the drop-down, select a status Active, Fixed, New, and Reopened to find vulnerabilities with certain status.
If you select the status as Fixed, the list will only show vulnerabilities that are fixed in the last 365 days.
Example
Show vulnerabilities with New status
finding.status:Fixed
finding.hidePatchSupersededfinding.hidePatchSuperseded
Use the boolean value True to generate the list of excluded superseded QIDs and show the latest patches.
Example
Show all the excluded superseded QIDs and the latest patches.
finding.hidePatchSuperseded:True
finding.ttr.firstFoundDatefinding.ttr.firstFoundDate
Use the number of days to determine the findings based on the Total and First Found time to remediate. The token accepts range input as number of days. You can also customize the range input.
Examples
- Show vulnerabilities findings based on total and first found calculation
finding.ttr.firstFoundDate:[61..90] - Use custom query to see the vulnerabilities findings based on total and first found calculation
finding.ttr.firstFoundDate:[0..90]
finding.tag.namefinding.tag.name
Use quotes or backticks within values to help you find the vulnerabilities tag.
Examples
- Show any findings related to this tag name
finding.tag.name: Microsoft Security Update - Show any findings that contain "Ubuntu" or "2021" in name
finding.tag.name:"Ubuntu 2021" - Show any findings that match exact value "centOS_security"
finding.tag.name:`centOS_security`
This token is available only to limited customers (in Beta phase).
finding.typeDetectedfinding.typeDetected
From the drop-down, select a detection type, such as, Confirmed, Potential, and Information to find assets with vulnerabilities of this type.
Example
Show findings with this type
finding.typeDetected:Confirmed
finding.vulnerability.authTypefinding.vulnerability.authType
From the drop-down, select the name, such as, WINDOWS_AUTH, UNIX_AUTH, ORACLE_AUTH of an authentication type.
Example
Show findings with Windows auth type
finding.vulnerability.authType:WINDOWS_AUTH
finding.vulnerability.bugTraqIdfinding.vulnerability.bugTraqId
Use a text value to find a BugTraq number.
Example
Show findings with BugTraq ID 22211
finding.vulnerability.bugTraqId:22211
finding.vulnerability.categoryfinding.vulnerability.category
From the drop-down, select a category, such as, `CGI`, `Database`, `DNS and BIND`, `Custom QID` to find vulnerabilities with this category.
Example
Show findings with category `CGI`
finding.vulnerability.category:`CGI`
finding.vulnerability.compliance.descriptionfinding.vulnerability.compliance.description
Use quotes or backticks within values to help you find the compliance description.
Examples
- Show any findings related to this description
finding.vulnerability.compliance.description:malicious software - Show any findings that contain "malicious" or "software" in description
finding.vulnerability.compliance.description:"malicious software" - Show any findings that match exact value "malicious software"
finding.vulnerability.compliance.description:`malicious software`
finding.vulnerability.compliance.sectionfinding.vulnerability.compliance.section
Use quotes or backticks within values to help you find the compliance section.
Examples
- Show any findings related to this section
finding.vulnerability.compliance.section:164.308 - Show any findings that contain parts of section
finding.vulnerability.compliance.section:"164.308" - Show any findings that match exact value "164.308"
finding.vulnerability.compliance.section:`164.308`
finding.vulnerability.compliance.typefinding.vulnerability.compliance.type
From the drop-down, select the name of a compliance type:
COBIT, HIPAA, GLBA, SOX, PCI
Examples
- Show findings with the compliance type HIPAA
finding.vulnerability.compliance.type:HIPAA - Show findings with the compliance type SOX
finding.vulnerability.compliance.type:SOX - Show findings with the compliance type COBIT
finding.vulnerability.compliance.type:COBIT
finding.vulnerability.impactfinding.vulnerability.impact
Use quotes or backtick within values to find the impact.
Examples
- Show any findings related to impact
finding.vulnerability.impact:sensitive information - Show any findings that contain "identity" or "theft" in consequence
finding.vulnerability.impact:"identity theft" - Show any findings that match exact value "financial loss"
finding.vulnerability.impact:`financial loss`
finding.vulnerability.cveIdfinding.vulnerability.cveId
Use a text value to find the CVE name.
Example
Show findings with CVE name CVE-2015-0313
finding.vulnerability.cveId:CVE-2015-0313
The CVE in the query is case sensitive and must be used in capital case.
finding.vulnerability.cvss3BaseScorefinding.vulnerability.cvss3BaseScore
Use an integer value to find the CVSSv3.1 base score.
Example
Show assets with this score
finding.vulnerability.cvss3BaseScore:7.8
finding.vulnerability.cvss3TemporalScorefinding.vulnerability.cvss3TemporalScore
Use an integer value to find the CVSSv3.1 temporal score.
Example
Show assets with this score
finding.vulnerability.cvss3TemporalScore:6.4
finding.vulnerability.cvss2AccessVectorfinding.vulnerability.cvss2AccessVector
Select the name of a CVSS2 access vector, for example, UNDEFINED, LOCAL_ACCESS, ADJACENT_NETWORK, NETWORK. Select from names in the drop-down menu.
Example
Show findings with this name
finding.vulnerability.cvss2AccessVector:NETWORK
finding.vulnerability.cvss2BaseScorefinding.vulnerability.cvss2BaseScore
Use an integer value to help you find the CVSS2 base score.
Example
Show assets with this score
finding.vulnerability.cvss2BaseScore:7.8
finding.vulnerability.cvss2TemporalScorefinding.vulnerability.cvss2TemporalScore
Use an integer value to help you find the CVSS2 temporal score.
Example
Show assets with this score
finding.vulnerability.cvss2TemporalScore:6.4
finding.vulnerability.discoveryTypefinding.vulnerability.discoveryType
Select a discovery type (Remote or Authenticated) to find assets with vulnerabilities having this discovery type. Select from names in the drop-down menu.
Example
Show findings with Remote discovery type
finding.vulnerability.discoveryType:REMOTE
finding.vulnerability.flagfinding.vulnerability.flag
Use a text value to find the Qualys defined vulnerability property, for example, REMOTE, WINDOWS_AUTH, UNIX_AUTH, PCI_RELATED etc.
Example
Show findings with this flag
finding.vulnerability.flag:PCI_RELATED
finding.vulnerability.mitre.attack.tactic.idfinding.vulnerability.mitre.attack.tactic.id
Use the text value within quotes or backticks for the tactics id that represents the why of the ATT&CK technique or sub-technique.
Example
Show findings with the Tactic ID TA0007
finding.vulnerability.mitre.attack.tactic.id:`TA0007`
finding.vulnerability.mitre.attack.tactic.namefinding.vulnerability.mitre.attack.tactic.name
Use the text value within quotes or backticks to view for the tactics name that represents its respective tactic id.
Example
Show findings with the tactic name initial-access
finding.vulnerability.mitre.attack.tactic.name:`initial-access`
finding.vulnerability.mitre.attack.technique.idfinding.vulnerability.mitre.attack.technique.id
Use the text value within quotes or backticks for the technique ID that represents how a tactical goal can be achieved.
Example
Show findings with the Technique ID T1562.010
finding.vulnerability.mitre.attack.technique.id:"T1562.010"
finding.vulnerability.mitre.attack.technique.namefinding.vulnerability.mitre.attack.technique.name
Use the text value within quotes or backticks to view for the technique name that represents its respective technique id.
Example
Show findings with the tactic name Downgrade Attack
finding.vulnerability.mitre.attack.technique.name:"Downgrade Attack"
finding.vulnerability.isPatchAvailablefinding.vulnerability.isPatchAvailable
Use the values true | false to define vulnerabilities with patch available.
Examples
- Show findings with patch available
finding.vulnerability.isPatchAvailable:TRUE - Show findings with no patch available
finding.vulnerability.isPatchAvailable:FALSE
finding.vulnerability.isPCIfinding.vulnerability.isPCI
Use the values true | false to find vulnerabilities that must be fixed for PCI Compliance (per PCI DSS).
Examples
- Show PCI vulnerabilities
finding.vulnerability.isPCI:TRUE - Do not show PCI vulnerabilities
finding.vulnerability.isPCI:FALSE
finding.vulnerability.isRebootRequiredfinding.vulnerability.isRebootRequired
Use the values true | false to find vulnerabilities that need reboot.
Example
Show vulnerabilities that need reboot.
finding.vulnerability.isRebootRequired: TRUE
finding.vulnerability.qidfinding.vulnerability.qid
Use an integer value to define the QID in question.
Example
Show findings with QID 90405
finding.vulnerability.qid: 90405
finding.vulnerability.ransomware.namefinding.vulnerability.ransomware.name
Use quotes or backticks within values to help you find the ransomware name you are looking for. Quotes can be used when the value has more than one word.
Examples
- Show findings with this name
finding.vulnerability.ransomware.name: Locky - Show findings that match exact value
finding.vulnerability.ransomware.name: Locky
finding.vulnerability.scaTechnologiesfinding.vulnerability.scaTechnologies
Use the SCA technology values like Python or Java for listing vulnerabilities associated with assets on which any of the software components are identified.
Example
List the vulnerabilities that have SCA Technology as Python
finding.vulnerability.scaTechnologies: Python
finding.vulnerability.sans20Categoriesfinding.vulnerability.sans20Categories
Use a text value to find vulnerabilities in the SANS 20 category, for example, Anti-virus Software, Backup Software, etc.
Example
Show findings with this category name
finding.vulnerability.sans20Categories:Media Players
finding.vulnerability.severityfinding.vulnerability.severity
Use an integer value to view the severity level set by Qualys to find assets having vulnerabilities. The severity level ranges between 1-5. Select from values in the drop-down menu.
Example
Show findings with severity set by Qualys as 5
finding.vulnerability.severity:5
For information about customer and Qualys severity, see Customer and Kb Severity Level.
finding.vulnerability.solutionfinding.vulnerability.solution
Use quotes or backticks within values to help you find the solution.
Examples
- Show any findings related to this solution
finding.vulnerability.solution:Bulletin MS10-006 - Show any findings that contain parts of solution
finding.vulnerability.solution:"Bulletin MS10-006" - Show any findings that match exact value "Bulletin MS10-006"
finding.vulnerability.solution:`Bulletin MS10-006`
finding.vulnerability.supportedBy.serviceNamefinding.vulnerability.supportedBy.serviceName
Select a Qualys service (VM, Agent type, etc) to show vulnerabilities that can be detected by this service. Select from names in the drop-down menu.
Example
Show vulnerabilities supported by Linux Agent
finding.vulnerability.supportedBy.serviceName:CA-Linux Agent
finding.vulnerability.titlefinding.vulnerability.title
Use quotes or backticks within values to help you find the title.
Examples
- Show any findings related to this title
finding.vulnerability.title:Remote Code Execution - Show any findings that contain "Remote" or "Code" in title
finding.vulnerability.title:"Remote Code" - Show any findings that match exact value "Remote Code"
finding.vulnerability.title:`Remote Code`
finding.vulnerability.vendorReffinding.vulnerability.vendorRef
Use a text value to find the vendor reference.
Example
Show this vendor reference
finding.vulnerability.vendorRef:KB3021953
finding.vulnerability.vendorProductNamefinding.vulnerability.vendorProductName
Use a text value to find the vendor product name.
Example
Show findings with this vendor product name
finding.vulnerability.vendorProductName:Windows
finding.vulnerability.vendorNamefinding.vulnerability.vendorName
Use a text value to find the vendor name.
Example
Show findings with this vendor name
finding.vulnerability.vendorName:Adobe
finding.nonRunningKernelfinding.nonRunningKernel
Use the values true | false to define vulnerabilities that exist on non exploitable kernels.
Example
Show findings on non-exploitable kernels
finding.nonRunningKernel:TRUE
finding.nonExploitableServicefinding.nonExploitableService
Use the values true | false to define vulnerabilities that exist on non-exploitable services.
Examples
Show findings on non-exploitable services
finding.nonExploitableService:TRUE
finding.vulnerability.patchReleasedDatefinding.vulnerability.patchReleasedDate
Use a date range or specific date to define when patch was available.
Examples
- Show findings last found within certain dates
finding.vulnerability.patchReleasedDate:[2018-10-21 ... 2019-01-15] - Show findings last found starting 2020-01-01, ending 1 month ago
finding.vulnerability.patchReleasedDate:[2020-01-01 ... now-1M] - Show findings last found starting 2 weeks ago, ending 1 second ago
finding.vulnerability.patchReleasedDate:[now-2w ... now-1s] - Show findings last found on certain date
finding.vulnerability.patchReleasedDate:'2020-01-02'
finding.timesFoundfinding.timesFound
Show findings that were detected for the specified number of times.
Example
Show findings last found 3 times
finding.timesFound:3
finding.vulnerability.kbAgefinding.vulnerability.kbAge
Select the number of days from the range (00..30, 31..60, 61..90, 91..180,180..+) since the vulnerability was published by Qualys in the Knowledge Base. The kbAge is the published date for the QIDs. Select the number of days from the drop-down menu.
Example
Show findings/QIDs that were recently published (in the last 30 days)
finding.vulnerability.kbAge:[00..30]
finding.detectionAgefinding.detectionAge
Select the number of days from the range (00..30, 31..60, 61..90, 91..180,180..+) since the vulnerability was first detected (by a scanner or cloud agent) on the asset till the current date. The age is calculated irrespective of the vulnerability status.
Example
Show findings that were detected in the last 30 days.
finding.detectionAge:[00..30]
finding.vulnerability.descriptionfinding.vulnerability.description
Use quotes or backticks within values to help you find the vulnerability description.
Examples
- Show any findings related to description
finding.vulnerability.description:remote code execution - Show any findings that contain "remote" or "code" in description
finding.vulnerability.description:"remote code execution" - Show any findings that match exact value "remote code execution"
finding.vulnerability.description:`remote code execution`
finding.vulnerability.listfinding.vulnerability.list
Use a text value to find the vulnerability list of interest, for example, SANS_20, QUALYS_20, QUALYS_INT_10, QUALYS_EXT_10).
Example
Show findings with vulnerabilities in SANS Top 20
finding.vulnerability.list:SANS_20
finding.vulnerability.publishedDatefinding.vulnerability.publishedDate
Use a date range or specific date to define when vulnerabilities were first published in the KnowledgeBase.
Examples
- Show findings for vulnerabilities published within certain dates
finding.vulnerability.publishedDate:[2015-10-21 ... 2016-01-15] - Show findings for vulnerabilities published starting 2017-01-01, ending 1 month ago
finding.vulnerability.publishedDate:[2017-01-01 ... now-1M] - Show findings for vulnerabilities published starting 2 weeks ago, ending 1 second ago
finding.vulnerability.publishedDate:[now-2w ... now-1s] - Show findings for vulnerabilities published on certain date
finding.vulnerability.publishedDate:'2018-01-15'
finding.vulnerability.riskfinding.vulnerability.risk
Use an integer value to define the vulnerability risk rating. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
finding.vulnerability.risk:50
finding.vulnerability.isQualysPatchablefinding.vulnerability.isQualysPatchable
Use the values true | false to define that can be patched at Qualys.
Examples
- Show vulnerabilities with patch available at Qualys
finding.vulnerability.isQualysPatchable: "true"
- Show vulnerabilities with patch not available at Qualys
finding.vulnerability.isQualysPatchable: "false"
finding.vulnerability.criticalityfinding.vulnerability.criticality
Select a criticality (for example, "CRITICAL","HIGH","MEDIUM","LOW","NONE") to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
If a QID does not have a CVSSv3 Base score, the CVSSv2 Base score takes priority.
The following list of criticality defines the CVSS Score from 0.0 to 10.0:
- None: 0.0
- Low: 0.1-3.9
- Medium: 4.0-6.9
- High: 7.0-8.9
- Critical: 9.0-10.0
Example
Show vulnerabilities with HIGH criticality
finding.vulnerability.criticality: "HIGH"
finding.vulnerability.updatedDatefinding.vulnerability.updatedDate
Use a date range or specific date to define when vulnerabilities were updated in the KnowledgeBase.
Examples
- Show vulnerabilities updated within certain dates
finding.vulnerability.updatedDate:[2017-10-21 ... 2017-10-30]
- Show vulnerabilities updated starting 2017-11-01, ending 1 month ago
finding.vulnerability.updatedDate:[2017-11-01 ... now-1M]
- Show vulnerabilities updated stating 2 weeks ago, ending 1 second ago
finding.vulnerability.updatedDate:[now-2w ... now-1s]
- Show vulnerabilities updated on certain date
finding.vulnerability.updatedDate:'2018-03-08'
finding.isQualysPatchablefinding.isQualysPatchable
Use the values true | false to indicate whether Qualys can patch a detected vulnerability.
Example
Show findings with vulnerabilities that can be patched
finding.isQualysPatchable:TRUE
finding.isQualysMitigablefinding.isQualysMitigable
Use the values true | false to indicate whether Qualys can mitigate a detected vulnerability.
Example
Show findings with vulnerabilities that can be mitigated
finding.isQualysMitigable:TRUE
This QQL is dependent on other modules. To use this QQL, ensure that all prerequisites are met.
Patch Management v3.0.0 and higher | Mitigation - v3.0 | ARSC Services - v1.10.0
finding.mitigated.statefinding.mitigated.state
Use this token to filter vulnerabilities based on their mitigation status.
Example
Show vulnerabilities that are completely fixed
finding.mitigated.state:Complete
To use this token, contact your technical account manager.
finding.mitigated.methodfinding.mitigated.method
Use this token to filter and identify vulnerabilities based on the specific method used to mitigate them. From the drop-down, select a method: TruRiskMitigate, PCControl, TruRiskIsolate
Example
- Show vulnerabilities mitigated by applying risk-based mitigation actions through the TruRisk approach
finding.mitigated.method:TruRiskMitigate - Show vulnerabilities mitigated by implementing compliance controls or configurations as defined in the Variable "policy_compliance_long" is not defined module
finding.mitigated.method:PCControl - Show vulnerabilities mitigated by isolating the associated asset or threat
finding.mitigated.method:TruRiskIsolate
To use this token, contact your technical account manager.
finding.isMitigatedfinding.isMitigated
Use the values true or false to filter vulnerabilities based on whether they have been mitigated.
Example
Show all mitigated vulnerabilities
finding.isMitigated:true
To use this token, contact your technical account manager.
finding.qualysMitigableTypefinding.qualysMitigableType
Use the values fix or mitigate to vulnerabilities based on the type of mitigation that Qualys can recommend or facilitate. This token helps identify actionable vulnerabilities through specific Qualys features, such as patching, configuration changes, or compensating controls.
Example
Show all fix vulnerabilities
finding.qualysMitigableType:Fix
finding.riskAcceptancefinding.riskAcceptance
Use the token to indicate different statuses for how a vulnerability is being handled or categorized.
You can select from the following options: RISK_ACCEPTED, FALSE_POSITIVE
Examples
- Show vulnerabilities where associated risks are accepted without immediate remediation
finding.riskAcceptance:RISK_ACCEPTED - Show vulnerabilities that were identified as a false positive, meaning it does not exist or are incorrectly flagged
finding.riskAcceptance:FALSE_POSITIVE
To use this token, contact your technical account manager.
finding.riskAcceptance.idfinding.riskAcceptance.id
Use this token to see vulnerabilities associated with a unique identifier that links it to a corresponding risk acceptance record.
Example
Show vulnerabilities associated with RiskAcceptanceID 12345
finding.riskAcceptance.id:12345
To use this token, contact your technical account manager.
finding.ttr.lastReopenedDatefinding.ttr.lastReopenedDate
Use a date range or specific date to define when findings were last reopened after being previously fixed. This token helps identify findings that were reopened and calculates the vulnerability age from the last reopened date instead of the first found date.
Vulnerability Age Calculation:
- For findings that are fixed: Vulnerability Age = Last Fixed Date - First Detected Date
- For findings that are reopened: Vulnerability Age = Last Fixed Date - Last Reopened Date
Example Scenario
Vulnerability age is calculated from First Detected.
- QID 123 – First Detected: 15th Nov 23 and Fixed date: 20th Nov 23, then Age = 5 days
- QID 123 – Reopened date: 1 Dec 23 and Fixed date: 10 Dec 23, then Age = 10 days
- Hence, the total age for QID 123 = 25 days.
Example
Show findings last reopened within certain dates
finding.ttr.lastReopenedDate: ["[0..3]","[4..7]","[8..15]","[16..30]","[31..60]","[61..90]","[91..180]","[181..365]","[366..+]"]
finding.riskFactor.cisaKEVDueDatefinding.riskFactor.cisaKEVDueDate
Use a date value or relative time to filter vulnerabilities based on the CISA Known Exploited Vulnerabilities (KEV) remediation due date. This token helps identify vulnerabilities that must be remediated by the due date specified in the CISA KEV catalog.
You can compare the due date using operators such as <, >, <=, >=, or specify a date range.
Examples
- Show findings with a CISA KEV due date earlier than the current time
finding.riskFactor.cisaKEVDueDate<now - Show findings with a CISA KEV due date within a specific date range
finding.riskFactor.cisaKEVDueDate:[2025-03-01 ... 2025-03-31] - Show Windows vulnerabilities listed in the CISA KEV catalog with a due date that has already passed
finding.vulnerability.threatIntel.cisaKnownExploitedVulns:TRUE and finding.vulnerability.category:`Windows` and finding.riskFactor.cisaKEVDueDate<now - Show KEV vulnerabilities detected in the last two weeks with a due date earlier than now
finding.vulnerability.threatIntel.cisaKnownExploitedVulns:TRUEandfinding.vulnerability.category:`Windows` and finding.riskFactor.cisaKEVDueDate<now andfinding.lastFound:[now-2w ... now-1s]
finding.vulnerability.cve.cisaKevDueDatefinding.vulnerability.cve.cisaKevDueDate
Use a date value or relative time to filter vulnerabilities based on the CISA Known Exploited Vulnerabilities (KEV) remediation due date at the CVE level. This token evaluates the KEV due date tied specifically to individual CVEs associated with a vulnerability, rather than the aggregated QID-level risk factor.
You can compare the due date using operators such as <, >, <=, >=, or specify a date range.
Examples
- Show findings with a CVE-level CISA KEV due date earlier than the current time
finding.vulnerability.cve.cisaKevDueDate < now - Show findings with a CVE-level KEV due date within a specific date range
finding.vulnerability.cve.cisaKevDueDate:[2025-03-01 ... 2025-03-31] - Show Windows vulnerabilities with CVEs listed in the CISA KEV catalog whose due date has already passed
finding.vulnerability.threatIntel.cisaKnownExploitedVulns:TRUE
and finding.vulnerability.category:`Windows`
and finding.vulnerability.cve.cisaKevDueDate < now - Show KEV CVEs detected in the last two weeks with a due date earlier than now
finding.vulnerability.threatIntel.cisaKnownExploitedVulns:TRUE
and finding.vulnerability.category:`Windows`
and finding.vulnerability.cve.cisaKevDueDate < now
and finding.lastFound:[now-2w ... now-1s]
finding.vulnerability.cvss4BaseScorefinding.vulnerability.cvss4BaseScore
Use a decimal value to help you find the CVSS v4 base score.
Example
Show assets with this score
finding.vulnerability.cvss4BaseScore: 8.6