Old and New Search Token Mappings
The token standardization for the Qualys Query Language (QQL) search tokens follows a standard naming convention.
The new token format follows the syntax: entity.attribute
For example, in the new token, policy.type, policy is the entity, and type is the attribute.
The events, policy, meetings, and response tokens, along with the tokens common to all Qualys applications, are now updated.
-
Only the new tokens are displayed in the auto-suggestion in the search bars within the UI. However, if you type the old token name manually, the QQL query still works. Old token names' visibility from the UI is removed.
-
The existing Dashboard widgets and Saved Search Queries will continue to support the old tokens. You can edit search queries and widgets to update the new tokens.
The following is the old and new tokens mapping list:
Application Token MappingApplication Token Mapping
| New Tokens | Old Tokens |
|---|---|
|
application.name |
name |
|
application.exposure |
exposure |
|
connector.type |
connector.type |
|
connector.name |
connector.name |
|
user.email |
users.email |
|
user.domain |
users.domain |
|
application.isTrusted |
isTrusted |
Control Token MappingControl Token Mapping
| New Tokens | Old Tokens |
|---|---|
|
control.id |
control.cid |
|
control.name |
control.name |
|
control.type |
control.type |
|
control.criticality |
control.criticality |
|
control.result |
control.result |
|
control.entityType |
control.entityType |
|
control.remediation |
control.remediation |
|
policy.name |
policy.name |
|
connector.name |
connector.name |
|
connector.type |
connector.type |
|
cloud.resource.id |
resource.id |
|
cloud.resource.name |
resource.name |
|
cloud.resource.result |
resource.result |
|
cloud.resource.type |
resource.type |
Document Token MappingDocument Token Mapping
|
New Tokens |
Old Tokens |
|---|---|
|
file.accessType |
accessType |
|
file.name |
name |
|
file.owner.email |
owner.email |
|
connector.type |
connector.type |
|
connector.name |
connector.name |
|
file.type |
type |
|
file.externalDomains |
externalDomains |
|
file.lastUpdatedBy.username |
lastUpdatedBy |
|
file.permissions.accessType |
permissions.accessType |
|
file.permissions.email |
permissions.email |
|
file.permissions.domain |
permissions.domain |
|
file.permissions.role |
permissions.role |
Event Token MappingEvent Token Mapping
|
New Tokens |
Old Tokens |
|---|---|
|
event.name |
name |
|
event.subCategory |
subCategory |
|
event.severity |
severity |
|
connector.type |
connector.type |
|
connector.name |
connector.name |
|
event.category |
category |
|
event.serviceType |
serviceType |
|
event.result |
actionDetail.result |
|
user.id |
actor.id |
|
user.email |
actor.email |
|
user.type |
actor.type |
|
event.source.ip |
origin.ip |
|
event.source.userAgent |
origin.userAgent |
|
event.modifiedResource.resourceId |
actionDetail.modifiedResources.resourceId |
|
event.modifiedResource.resourceName |
actionDetail.modifiedResources.resourceName |
Group Token MappingGroup Token Mapping
|
New Tokens |
Old Tokens |
|---|---|
|
group.accessType |
accessType |
|
group.name |
name |
|
group.email |
|
|
connector.type |
connector.type |
|
connector.name |
connector.name |
|
group.members.domain |
members.domain |
|
group.members.email |
members.email |
|
group.members.role |
members.role |
|
group.members.accessType |
members.accessType |
Meeting Token MappingMeeting Token Mapping
| New Tokens | Old Tokens |
|---|---|
|
meeting.id |
meetingId |
|
meeting.host.email |
hostUser.email |
|
connector.type |
connector.type |
|
connector.name |
|
|
meeting.host.department |
hostUser.department |
|
meeting.host.fullName |
hostUser.fullName |
|
meeting.name |
name |
|
meeting.type |
type |
|
meeting.accessType |
accessType |
|
meeting.participants.email |
participants.email |
|
meeting.participants.fullName |
participants.fullName |
|
meeting.participants.domain |
participants.domain |
|
meeting.recordings.id |
recordings.id |
|
meeting.recordings.fileType |
recordings.fileType |
|
meeting.recordings.recordingType |
recordings.recordingType |
|
meeting.recordingSetting.accessType |
recordingSetting.accessType |
|
meeting.recordingSetting.isViewerDownloadable |
recordingSetting.viewerDownload |
|
meeting.recordingSetting.approvalType |
recordingSetting.approvalType |
|
meeting.recordingSetting.isOnDemand |
recordingSetting.onDemand |
Policy Token MappingPolicy Token Mapping
| New Tokens | Old Tokens |
|---|---|
|
policy.type |
policy.type |
|
connector.type |
connector.type |
Policy Control Token MappingPolicy Control Token Mapping
| New Tokens | Old Tokens |
|---|---|
|
control.type |
control.type |
|
control.criticality |
control.criticality |
|
connector.type |
connector.type |
|
control.id |
control.cid |
|
control.name |
control.name |
Remediation Token MappingRemediation Token Mapping
| New Tokens | Old Tokens |
|---|---|
|
job.status |
status |
|
job.owner |
owner |
|
cloud.resource.id |
resource.id |
Report Token MappingReport Token Mapping
|
New Tokens |
Old Tokens |
|---|---|
|
report.name |
reportName |
|
report.createdBy.username |
createdBy |
|
report.status |
status |
User Token MappingUser Token Mapping
|
New Tokens |
Old Tokens |
|---|---|
|
user.fullName |
fullName |
|
user.email |
|
|
connector.type |
connector.type |
|
user.role |
role |
|
user.accessType |
accessType |
|
user.department |
department |
|
user.jobTitle |
jobTitle |
|
user.domain |
domain |
|
user.isSuspended |
isSuspended |
|
user.isLicensed |
isLicensed |