Search Tokens for Scans and Models
Syntax help displayed in UI for tokens. Click each token to learn more about it.
Note:
- For all the date-related tokens, the date search is evaluated only for UTC format. The actual search results might show you the date as per your time zone.
- For the range searches, remember that the QQL search tokens are case-sensitive. Hence, make sure that you enter the correct token syntax. For more information, see Range Searches.
- While using the nested QQL queries for software-related tokens using the 'not' operator and multiple values in [], the placement of 'not' is very important. Make sure to enter the correct token syntax. Otherwise, you will not get the expected results. For more information, see the Nested Queries section from the How to Search topic.
Scans Tokens
Select a severity value to find scans with selected scan severity: HIGH, LOW, MEDIUM, NONE.
Example
Find scans with the specified scan severity LOW
scan.severity: LOW
Use values within quotes or backticks to find scans with the specified scan name.
Examples
Find scans that contain a part of the given name
scan.name: "TestScan"
Find scans with the given name
scan.name: `TestScan`
Use an integer value to find scans with the given scan ID.
Example
Find the scan with the given ID
scan.id: 30
Select status to find scans with selected scan status - ERROR, FINISHED, NO_HOST_ALIVE, PENDING EVALUATION, PENDING REPORTS, PROCESSING, RUNNING, SCANNER_NOT_AVAILABLE, SUBMITTED.
Example
Find scans with the FINISHED status
scan.status: FINISHED
Asset Tokens
Use values within quotes or backticks to search models or MCP servers with the specified name.
Examples
Show any findings that match the beginning of any substrings within the model or MCP servers name.
asset.name:"Llama for Ecommerce App"
Show any findings that match specified model or MCP servers name.
asset.name:`Llama for Ecommerce App`
Use a an integer value to find models with the specified model or MCP server ID.
Example
Find models or MCP servers with the ID 123
asset.id: 123
Use values within quotes or backticks to find scans for models or MCP servers that are associated with the specified tag(s).
Examples
Find scans models or MCP servers that have part of the tag named "Test" associated.
asset.tag.name:"Test"
Find scans models or MCP servers that have part of the tag named "Test" or "Production" associated.
asset.tag.name:["Test", "Production"]
Find scans models or MCP servers that have the tag name `Target1` associated.
asset.tag.name:`Target1`