↵
Search Tokens for Dynamic Tagging
Use the following tokens to define search criteria for dynamic tagging:
asset.riskScoreasset.riskScore
Use an integer value 0-1000 to find assets based on specific asset risk score.
Example
Show assets with risk score 60
asset.riskScore:"60"
vulnerabilities.vulnerability.qidvulnerabilities.vulnerability.qid
Use an integer value to define the QID in question.
Example
Show findings with QID 90405
vulnerabilities.vulnerability.qid:90405
vulnerabilities.severityvulnerabilities.severity
Use an integer value to view the severity level set by you to find assets having vulnerabilities. The severity level ranges between 1-5. Select from values in the drop-down menu. If you do not set the severity level, its level will be the same as the level set by Qualys.
Example
Show findings with severity by 5
vulnerabilities.severity:5
For information about customer and Qualys severity, see Customer and Kb Severity Level
vulnerabilities.typeDetectedvulnerabilities.typeDetected
Select a detection type (e.g. Confirmed, Potential, Information) to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
Example
Show findings with this type
vulnerabilities.typeDetected:Confirmed
vulnerabilities.isFoundvulnerabilities.isFound
Use the values true | false to define vulnerabilities are detected or not on the assets.
Examples
Show findings with vulnerabilities detected
vulnerabilities.isFound:TRUE
vulnerabilities.statusvulnerabilities.status
Select a status (e.g. Active, Fixed, New, Reopened) to find vulnerabilities with certain status. Select from names in the drop-down menu.
If you select the status as Fixed, the list will only show vulnerabilities that are fixed in the last 365 days.
Example
Show vulnerabilities with New status
vulnerabilities.status:NEW
vulnerabilities.host.asset.name vulnerabilities.host.asset.name
Use quotes or backticks within values to help you find the host asset name.
Examples
Show any findings related to name
vulnerabilities.host.asset.name:QK2K12QP3-65-53
Show any findings that contain parts of name
vulnerabilities.host.asset.name:"QK2K12QP3-65-53"
Show any findings that match exact value "QK2K12QP3-65-53"
vulnerabilities.host.asset.name:`QK2K12QP3-65-53`
vulnerabilities.isIgnoredvulnerabilities.isIgnored
Use an integer value to find vulnerabilities that have been marked as ignored.
Example
Show vulnerabilities that are marked as ignored
vulnerabilities.isIgnored:TRUE
vulnerabilities.isDisabledvulnerabilities.isDisabled
Use the values true | false to define vulnerabilities are disabled or enabled.
Examples
Show findings with vulnerabilities disabled
vulnerabilities.isDisabled:TRUE
vulnerabilities.portvulnerabilities.port
Use an integer value to help you find vulnerabilities found on a certain port.
Example
Show vulnerabilities found on this port
vulnerabilities.port:443
vulnerabilities.protocolvulnerabilities.protocol
Use a text value (UDP or TCP) to define the port protocol.
Example
Show vulnerabilities found on TCP protocol
vulnerabilities.protocol:TCP
vulnerabilities.instancevulnerabilities.instance
Use a text value to help you find vulnerabilities found on a certain instance.
Example
Show vulnerabilities found in this instance
vulnerabilities.instance:oracle
vulnerabilities.nonRunningKernelvulnerabilities.nonRunningKernel
Use the values true | false to view vulnerabilities found on non-running kernels.
Examples
Show detections found on non-running Kernal
vulnerabilities.nonRunningKernel:TRUE
Show detections found on running Kernal
vulnerabilities.nonRunningKernel:FALSE
vulnerabilities.nonExploitableServicevulnerabilities.nonExploitableService
Use the values true | false to define vulnerabilities that exist on non exploitable services.
Examples
Show findings on non-exploitable services
vulnerabilities.nonExploitableService:TRUE
vulnerabilities.nonExploitableConfigvulnerabilities.nonExploitableConfig
Use the values true or false to define vulnerabilities with non-exploitable configurations.
Examples
Show findings with non exploitable configurations
vulnerabilities.nonExploitableConfig:TRUE
Show findings with exploitable configurations
vulnerabilities.nonExploitableConfig:FALSE
vulnerabilities.detectionScorevulnerabilities.detectionScore
Use an integer value (0-100) to help you find vulnerabilities based on specific detection score.
Examples
Show vulnerabilities with detection score 80
vulnerabilities.detectionScore:80
Show vulnerabilities with detection score 25
vulnerabilities.detectionScore:25
vulnerabilities.vulnerability.isQualysPatchablevulnerabilities.vulnerability.isQualysPatchable
Use the valuesvulnerabilities true | false to define that can be patched at Qualys.
Examples
Show vulnerabilities with patch available at Qualys
vulnerabilities.vulnerability.isQualysPatchable:"true"
Show vulnerabilities with patch not available at Qualys
vulnerabilities.vulnerability.isQualysPatchable:"false"
vulnerabilities.vulnerability.criticalityvulnerabilities.vulnerability.criticality
Select a criticality (e.g. "CRITICAL","HIGH","MEDIUM","LOW","NONE") to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
If a QID does not have a CVSSv3 Base score, the CVSSv2 Base score takes the priority.
The following list of criticality defines the CVSS Score from 0.0 to 10.0:
- None: 0.0
- Low: 0.1-3.9
- Medium: 4.0-6.9
- High: 7.0-8.9
- Critical: 9.0-10.0
Examples
Show vulnerabilities with HIGH criticality
vulnerabilities.vulnerability.criticality:"HIGH"
vulnerabilities.vulnerability.descriptionvulnerabilities.vulnerability.description
Use quotes or backticks within values to help you find the vulnerability description.
Examples
Show any findings related to description
vulnerabilities.vulnerability.description:remote code execution
Show any findings that contain "remote" or "code" in description
vulnerabilities.vulnerability.description:"remote code execution"
Show any findings that match exact value "remote code execution"
vulnerabilities.vulnerability.description:`remote code execution`
vulnerabilities.vulnerability.riskvulnerabilities.vulnerability.risk
Use an integer value to define the vulnerability risk rating. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
vulnerabilities.vulnerability.risk:50
vulnerabilities.vulnerability.isPatchAvailablevulnerabilities.vulnerability.isPatchAvailable
Use the values true | false to define vulnerabilities with patch available.
Examples
Show findings with patch available
vulnerabilities.vulnerability.isPatchAvailable:TRUE
Show findings with no patch available
vulnerabilities.vulnerability.isPatchAvailable:FALSE
vulnerabilities.vulnerability.vendorProductNamevulnerabilities.vulnerability.vendorProductName
Use a text value to find the vendor product name.
Example
Show findings with this vendor product name
vulnerabilities.vulnerability.vendorProductName:Windows
vulnerabilities.vulnerability.vendorNamevulnerabilities.vulnerability.vendorName
Use a text value to find the vendor name.
Example
Show findings with this vendor name
vulnerabilities.vulnerability.vendorName:Adobe
vulnerabilities.vulnerability.titlevulnerabilities.vulnerability.title
Use quotes or backticks within values to help you find the title.
Examples
Show any findings related to this title
vulnerabilities.vulnerability.title:Remote Code Execution
Show any findings that contain "Remote" or "Code" in title
vulnerabilities.vulnerability.title:"Remote Code"
Show any findings that match exact value "Remote Code"
vulnerabilities.vulnerability.title:`Remote Code`
vulnerabilities.vulnerability.isRebootRequiredvulnerabilities.vulnerability.isRebootRequired
Use the values true | false to find vulnerabilities that need reboot.
Examples
Show vulnerabilities that need reboot.
vulnerabilities.vulnerability.isRebootRequired:TRUE
Use the values true | false to define real-time threats due to active attacks.
Examples
Show assets with threats due to active attacks
vulnerabilities.vulnerability.threatIntel.isActiveAttack:true
Show assets that don't have threats due to active attacks
vulnerabilities.vulnerability.threatIntel.isActiveAttack:false
Use the values true | false to define real-time threats due to denial of service.
Examples
Show assets with threats due to denial of service
vulnerabilities.vulnerability.threatIntel.isDenialOfService:true
Show assets that don't have threats due to denial of servic
vulnerabilities.vulnerability.threatIntel.isDenialOfService:false
Use the values true | false to define real-time threats due to easy exploit.
Examples
Show assets with threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.isEasyExploit:true
Show assets that don't have threats due to easy exploit
vulnerabilities.vulnerability.threatIntel.isEasyExploit:false
Use the values true | false to define real-time threats due to high data loss.
Examples
Show assets with threats due to high data loss
vulnerabilities.vulnerability.threatIntel.isHighDataLoss:true
Show assets that don't have threats due to high data loss
vulnerabilities.vulnerability.threatIntel.isHighDataLoss:false
Use the values true | false to define real-time threats due to exploit kit.
Examples
Show assets with threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit:true
Show assets that don't have threats due to exploit kit
vulnerabilities.vulnerability.threatIntel.exploitKit:false
Use the values true | false to define real-time threats due to high lateral movement.
Examples
Show assets with threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.isHighLateralMovement:true
Show assets that don't have threats due to high lateral movement
vulnerabilities.vulnerability.threatIntel.isHighLateralMovement:false
Use the values true | false to define real-time threats due to malware.
Examples
Show assets with threats due to malware
vulnerabilities.vulnerability.threatIntel.isMalware:true
Show assets that don't have threats due to malware
vulnerabilities.vulnerability.threatIntel.isMalware:false
Use the values true | false to define real-time threats due to no patch available.
Examples
Show assets with threats due to no patch available
vulnerabilities.vulnerability.threatIntel.hasNoPatch:true
Show assets that don't have threats due to no patch available
vulnerabilities.vulnerability.threatIntel.hasNoPatch:false
Use the values true | false to define real-time threats due to public exploit.
Example
Show assets with threats due to public exploit
vulnerabilities.vulnerability.threatIntel.isPublicExploit:true
Show assets that don't have threats due to public exploit
vulnerabilities.vulnerability.threatIntel.isPublicExploit:false
Use the values true | false to define real-time threats due to zero day exploit.
Examples
Show assets with threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.isZeroDay:true
Show assets that don't have threats due to zero day exploit
vulnerabilities.vulnerability.threatIntel.isZeroDay:false
Use the values true | false to define real-time wormable threats.
Example
Show assets with wormable threats
vulnerabilities.vulnerability.threatIntel.isWormable:"true"
Use the values true | false to define real-time threats due to predicted high risk.
Example
Show assets with predicted high risk threat
vulnerabilities.vulnerability.threatIntel.isPredictedHighRisk:"true"
Use the values true | false to define real-time threats due to unauthenticated exploitation risk.
Example
Show assets with unauthenticated exploitation threat
vulnerabilities.vulnerability.threatIntel.isUnauthenticatedExploitation:"true"
Use the values true | false to define real-time threats due to remote code execution risk.
Example
Show assets with remote code execution threat
vulnerabilities.vulnerability.threatIntel.isRemoteCodeExecution:"true"
Use the values true | false to define real-time threats due to privilege escalation risk.
Example
Show assets with privilege escalation threat
vulnerabilities.vulnerability.threatIntel.isPrivilegeEscalation:"true"
Use the values true | false to define real-time threats due to ransomeware vulnerability.
Example
Show assets with ransomeware threat
vulnerabilities.vulnerability.threatIntel.isRansomware:"true"
Use the values true | false to filter real-time threats due to Solorigate/Sunburst risk.
Example
Show assets with Solorigate/Sunburst threat
vulnerabilities.vulnerability.threatIntel.isSolorigateSunburst:"true"
Use the values true | false to define real-time threats due to CISA Exploits.
Examples
Show assets with threats due to CISA exploit
ulnerabilities.vulnerability.threatIntel.isCisaKnownExploitedVuln:true
Show assets that don't have threats due to CISA exploit
vulnerabilities.vulnerability.threatIntel.isCisaKnownExploitedVuln:false
vulnerabilities.detectionSource.namevulnerabilities.detectionSource.name
Use quotes or backticks within values to help you find the source that detected the vulnerability. Understanding the origin of vulnerability data is essential for grasping the detection's context, reliability, and scope.
Examples
Show findings with Qualys as the detection source
vulnerabilities.detectionSource.name:AZURE
Show findings that contain parts of the detection source
vulnerabilities.detectionSource.name:"CAR Agent"
Show findings that match the exact value Qualys
vulnerabilities.detectionSource.name:`Cloud Agent`
vulnerabilities.riskFactor.isCisaKnownExploitvulnerabilities.riskFactor.isCisaKnownExploit
Use this token to get the list of QIDs impacted due to CISA Known Exploits. The token uses true or false as the input value.
Example
List the QIDs that are impacted due to CISA Known Exploit
vulnerabilities.riskFactor.isCisaKnownExploit:TRUE
vulnerabilities.riskFactor.exploitCodeMaturityvulnerabilities.riskFactor.exploitCodeMaturity
Use this token to get the list of QIDs that can be exploited based on the existing state of exploit techniques and code availability.
From the drop-down, select the name of an exploit technique:
poc, weaponized
Example
List the QIDs exploited by Weaponized exploit code maturity technique
vulnerabilities.riskFactor.exploitCodeMaturity:"weaponized"
vulnerabilities.riskFactor.exploitTypevulnerabilities.riskFactor.exploitType
Use string as an input value to get the list of QIDs based on the type of exploits and its related vulnerabilities.
Example
List the QIDs that are exploited whose target vulnerabilities are in web applications
vulnerabilities.riskFactor.exploitType:"webapps"
vulnerabilities.riskFactor.exploitType:"shellcode"
vulnerabilities.riskFactor.exploitType:"remote"
vulnerabilities.riskFactor.malwareNamevulnerabilities.riskFactor.malwareName
Use string as an input value to get the list of QIDs that are impacted by the malware name.
Example
List the QIDs that are impacted by the malware name TROJ_PDFKA.DQ
vulnerabilities.riskFactor.malwareName:"TROJ_PDFKA.DQ"
vulnerabilities.riskFactor.rtivulnerabilities.riskFactor.rti
Use this token to get the list of QIDs with Real-Time Threat Indicators (RTI) related vulnerabilities.
Example
associatedIDs that are assoicated with the Denial_of_Service Real-Time Threat Indicator
vulnerabilities.riskFactor.rti:"Denial_of_Service"
vulnerabilities.riskFactor.threatActorNamevulnerabilities.riskFactor.threatActorName
Use string as an input value to get the list of QIDs that are impacted by the threat actor.
Example
List the QIDs that are impacted by the threat actor name Labyrinth Chollima
vulnerabilities.riskFactor.threatActorName:"Labyrinth Chollima"
List the QIDs that are impacted by the threat actor name Insiders
vulnerabilities.riskFactor.threatActorName:"Insiders"
List the QIDs that are impacted by the threat actor name Senstive Information
vulnerabilities.riskFactor.threatActorName:"senstive information"
List the QIDs that are impacted by the threat actor name Script Kiddies
vulnerabilities.riskFactor.threatActorName:"Script kiddies"
vulnerabilities.vulnerability.cveIdvulnerabilities.vulnerability.cveId
Use a text value to find the CVE name.
Example
Show findings with CVE name CVE-2015-0313
vulnerabilities.vulnerability.cveId:CVE-2015-0313
Note: The CVE in the query is case sensitive and must be used in capital case.
vulnerabilities.vulnerability.cvss2BaseScorevulnerabilities.vulnerability.cvss2BaseScore
Use an integer value to help you find the CVSS2 base score.
Example
Show assets with this score
vulnerabilities.vulnerability.cvss2BaseScore:7.8
vulnerabilities.vulnerability.cvss3BaseScorevulnerabilities.vulnerability.cvss3BaseScore
Use an integer value to find the CVSSv3.1 base score.
Example
Show assets with this score
vulnerabilities.vulnerability.cvss3BaseScore:7.8
Use the text value within quotes or backticks for the tactics id that represents the why of the ATT&CK technique or sub-technique.
Example
Show findings with the Tactic ID TA0007
vulnerabilities.vulnerability.mitre.attack.tactic.id:`TA0007`
Use the text value within quotes or backticks for the technique id that represents how a tactical goal can be achieved.
Example
Show findings with the Technique ID T1562.010
vulnerabilities.vulnerability.mitre.attack.technique.id:"T1562.010"
vulnerabilities.vulnerability.isPCIvulnerabilities.vulnerability.isPCI
Use the values true | false to find vulnerabilities that must be fixed for PCI Compliance (per PCI DSS).
Examples
Show PCI vulnerabilities
vulnerabilities.vulnerability.isPCI:TRUE
Do not show PCI vulnerabilities
vulnerabilities.vulnerability.isPCI:FALSE
vulnerabilities.vulnerability.ransomware.namevulnerabilities.vulnerability.ransomware.name
Use quotes or backticks within values to help you find the ransomware name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show findings with this name
vulnerabilities.vulnerability.ransomware.name:Locky
Show findings that match exact value
vulnerabilities.vulnerability.ransomware.name:Locky
vulnerabilities.vulnerability.severityvulnerabilities.vulnerability.severity
Use an integer value to view the severity level set by Qualys to find assets having vulnerabilities. The severity level ranges between 1-5. Select from values in the drop-down menu.
Example
Show findings with severity set by Qualys as 5
vulnerabilities.vulnerability.severity:5
For information about customer and Qualys severity, see Customer and Kb Severity Level.
vulnerabilities.isQualysMitigablevulnerabilities.isQualysMitigable
Use the values true | false to indicate whether Qualys can mitigate a detected vulnerability.
Example
Show findings with vulnerabilities that can be mitigated
vulnerabilities.isQualysMitigable:TRUE
This QQL is dependent on other modules. To use this QQL, ensure that all prerequisites are met.
Patch Management v3.0.0 and higher | Mitigation - v3.0 | ARSC Services - v1.10.0
vulnerabilities.isQualysPatchablevulnerabilities.isQualysPatchable
Use the values true | false to indicate whether Qualys can patch a detected vulnerability.
Example
Show findings with vulnerabilities that can be patched
vulnerabilities.isQualysPatchable:TRUE
finding.vulnerability.qidfinding.vulnerability.qid
Use an integer value to define the QID in question.
Example
Show findings with QID 90405
finding.vulnerability.qid:90405
finding.severityfinding.severity
Use an integer value to view the severity level set by you to find assets having vulnerabilities. The severity level ranges between 1-5. Select from values in the drop-down menu. If you do not set the severity level, its level will be the same as the level set by Qualys.
Example
Show findings with severity by 5
finding.severity:5
For information about customer and Qualys severity, see Customer and Kb Severity Level
finding.typeDetectedfinding.typeDetected
Select a detection type (e.g. Confirmed, Potential, Information) to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
Example
Show findings with this type
finding.typeDetected:Confirmed
finding.isFoundfinding.isFound
Use the values true | false to define vulnerabilities are detected or not on the assets.
Examples
Show findings with vulnerabilities detected
finding.isFound:TRUE
Select a status (e.g. Active, Fixed, New, Reopened) to find vulnerabilities with certain status. Select from names in the drop-down menu.
If you select the status as Fixed, the list will only show vulnerabilities that are fixed in the last 365 days.
Example
Show vulnerabilities with New status
finding.status:NEW
finding.host.asset.namefinding.host.asset.name
Use quotes or backticks within values to help you find the host asset name.
Examples
Show any findings related to name
finding.host.asset.name:QK2K12QP3-65-53
Show any findings that contain parts of name
finding.host.asset.name:"QK2K12QP3-65-53"
Show any findings that match exact value "QK2K12QP3-65-53"
finding.host.asset.name:`QK2K12QP3-65-53`
finding.isIgnoredfinding.isIgnored
Use an integer value to find vulnerabilities that have been marked as ignored.
Example
Show vulnerabilities that are marked as ignored
finding.isIgnored:TRUE
finding.isDisabledfinding.isDisabled
Use the values true | false to define vulnerabilities are disabled or enabled.
Examples
Show findings with vulnerabilities disabled
finding.isDisabled:TRUE
Use an integer value to help you find vulnerabilities found on a certain port.
Example
Show vulnerabilities found on this port
finding.port:443
finding.protocolfinding.protocol
Use a text value (UDP or TCP) to define the port protocol.
Example
Show vulnerabilities found on TCP protocol
finding.protocol
finding.instancefinding.instance
Use a text value to help you find vulnerabilities found on a certain instance.
Example
Show vulnerabilities found in this instance
finding.instance:oracle
finding.nonRunningKernelfinding.nonRunningKernel
Use the values true | false to view vulnerabilities found on non-running kernels.
Examples
Show detections found on non-running Kernal
finding.nonRunningKernel:TRUE
Show detections found on running Kernal
finding.nonRunningKernel:FALSE
finding.nonExploitableServicefinding.nonExploitableService
Use the values true | false to define vulnerabilities that exist on non exploitable services.
Examples
Show findings on non-exploitable services
finding.nonExploitableService:TRUE
finding.nonExploitableConfigfinding.nonExploitableConfig
Use the values true or false to define vulnerabilities with non-exploitable configurations.
Examples
Show findings with non exploitable configurations
finding.nonExploitableConfig:TRUE
Show findings with exploitable configurations
finding.nonExploitableConfig:FALSE
Use an integer value (0-100) to help you find vulnerabilities based on specific detection score.
Examples
Show vulnerabilities with detection score 80
finding.qds:80
Show vulnerabilities with detection score 25
finding.qds:25
finding.vulnerability.isQualysPatchablefinding.vulnerability.isQualysPatchable
Use the valuesvulnerabilities true | false to define that can be patched at Qualys.
Examples
Show vulnerabilities with patch available at Qualys
finding.vulnerability.isQualysPatchable:"true"
Show vulnerabilities with patch not available at Qualys
finding.vulnerability.isQualysPatchable:"false"
finding.vulnerability.criticalityfinding.vulnerability.criticality
Select a criticality (e.g. "CRITICAL","HIGH","MEDIUM","LOW","NONE") to find assets with vulnerabilities of this type. Select from names in the drop-down menu.
If a QID does not have a CVSSv3 Base score, the CVSSv2 Base score takes the priority.
The following list of criticality defines the CVSS Score from 0.0 to 10.0:
- None: 0.0
- Low: 0.1-3.9
- Medium: 4.0-6.9
- High: 7.0-8.9
- Critical: 9.0-10.0
Examples
Show vulnerabilities with HIGH criticality
finding.vulnerability.criticality:"HIGH"
finding.vulnerability.descriptionfinding.vulnerability.description
Use quotes or backticks within values to help you find the vulnerability description.
Examples
Show any findings related to description
finding.vulnerability.description:remote code execution
Show any findings that contain "remote" or "code" in description
finding.vulnerability.description:"remote code execution"
Show any findings that match exact value "remote code execution"
finding.vulnerability.description:`remote code execution`
finding.vulnerability.riskfinding.vulnerability.risk
Use an integer value to define the vulnerability risk rating. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
finding.vulnerability.risk:50
finding.vulnerability.isPatchAvailablefinding.vulnerability.isPatchAvailable
Use the values true | false to define vulnerabilities with patch available.
Examples
Show findings with patch available
finding.vulnerability.isPatchAvailable:TRUE
Show findings with no patch available
finding.vulnerability.isPatchAvailable:FALSE
finding.vulnerability.vendorProductNamefinding.vulnerability.vendorProductName
Use a text value to find the vendor product name.
Example
Show findings with this vendor product name
finding.vulnerability.vendorProductName:Windows
finding.vulnerability.vendorNamefinding.vulnerability.vendorName
Use a text value to find the vendor name.
Example
Show findings with this vendor name
finding.vulnerability.vendorName:Adobe
finding.vulnerability.titlefinding.vulnerability.title
Use quotes or backticks within values to help you find the title.
Examples
Show any findings related to this title
finding.vulnerability.title:Remote Code Execution
Show any findings that contain "Remote" or "Code" in title
finding.vulnerability.title:"Remote Code"
Show any findings that match exact value "Remote Code"
finding.vulnerability.title:`Remote Code`
finding.vulnerability.isRebootRequiredfinding.vulnerability.isRebootRequired
Use the values true | false to find vulnerabilities that need reboot.
Examples
Show vulnerabilities that need reboot.
finding.vulnerability.isRebootRequired:TRUE
finding.vulnerability.threatIntel.isActiveAttackfinding.vulnerability.threatIntel.isActiveAttack
Use the values true | false to define real-time threats due to active attacks.
Examples
Show assets with threats due to active attacks
finding.vulnerability.threatIntel.isActiveAttack:true
Show assets that don't have threats due to active attacks
finding.vulnerability.threatIntel.isActiveAttack:false
Use the values true | false to define real-time threats due to denial of service.
Examples
Show assets with threats due to denial of service
finding.vulnerability.threatIntel.isDenialOfService:true
Show assets that don't have threats due to denial of servic
finding.vulnerability.threatIntel.isDenialOfService:false
finding.vulnerability.threatIntel.isEasyExploitfinding.vulnerability.threatIntel.isEasyExploit
Use the values true | false to define real-time threats due to easy exploit.
Examples
Show assets with threats due to easy exploit
finding.vulnerability.threatIntel.isEasyExploit:true
Show assets that don't have threats due to easy exploit
finding.vulnerability.threatIntel.isEasyExploit:false
finding.vulnerability.threatIntel.isHighDataLossfinding.vulnerability.threatIntel.isHighDataLoss
Use the values true | false to define real-time threats due to high data loss.
Examples
Show assets with threats due to high data loss
finding.vulnerability.threatIntel.isHighDataLoss:true
Show assets that don't have threats due to high data loss
finding.vulnerability.threatIntel.isHighDataLoss:false
finding.vulnerability.threatIntel.exploitKitfinding.vulnerability.threatIntel.exploitKit
Use the values true | false to define real-time threats due to exploit kit.
Examples
Show assets with threats due to exploit kit
finding.vulnerability.threatIntel.exploitKit:true
Show assets that don't have threats due to exploit kit
finding.vulnerability.threatIntel.exploitKit:false
Use the values true | false to define real-time threats due to high lateral movement.
Examples
Show assets with threats due to high lateral movement
finding.vulnerability.threatIntel.isHighLateralMovement:true
Show assets that don't have threats due to high lateral movement
finding.vulnerability.threatIntel.isHighLateralMovement:false
finding.vulnerability.threatIntel.isMalwarefinding.vulnerability.threatIntel.isMalware
Use the values true | false to define real-time threats due to malware.
Examples
Show assets with threats due to malware
finding.vulnerability.threatIntel.isMalware:true
Show assets that don't have threats due to malware
finding.vulnerability.threatIntel.isMalware:false
finding.vulnerability.threatIntel.hasNoPatchfinding.vulnerability.threatIntel.hasNoPatch
Use the values true | false to define real-time threats due to no patch available.
Examples
Show assets with threats due to no patch available
finding.vulnerability.threatIntel.hasNoPatch:true
Show assets that don't have threats due to no patch available
finding.vulnerability.threatIntel.hasNoPatch:false
finding.vulnerability.threatIntel.isPublicExploitfinding.vulnerability.threatIntel.isPublicExploit
Use the values true | false to define real-time threats due to public exploit.
Example
Show assets with threats due to public exploit
finding.vulnerability.threatIntel.isPublicExploit:true
Show assets that don't have threats due to public exploit
finding.vulnerability.threatIntel.isPublicExploit:false
finding.vulnerability.threatIntel.isZeroDayfinding.vulnerability.threatIntel.isZeroDay
Use the values true | false to define real-time threats due to zero day exploit.
Examples
Show assets with threats due to zero day exploit
finding.vulnerability.threatIntel.isZeroDay:true
Show assets that don't have threats due to zero day exploit
finding.vulnerability.threatIntel.isZeroDay:false
finding.vulnerability.threatIntel.isWormablefinding.vulnerability.threatIntel.isWormable
Use the values true | false to define real-time wormable threats.
Example
Show assets with wormable threats
finding.vulnerability.threatIntel.isWormable:"true"
Use the values true | false to define real-time threats due to predicted high risk.
Example
Show assets with predicted high risk threat
finding.vulnerability.threatIntel.isPredictedHighRisk:"true"
Use the values true | false to define real-time threats due to unauthenticated exploitation risk.
Example
Show assets with unauthenticated exploitation threat
finding.vulnerability.threatIntel.isUnauthenticatedExploitation:"true"
Use the values true | false to define real-time threats due to remote code execution risk.
Example
Show assets with remote code execution threat
finding.vulnerability.threatIntel.isRemoteCodeExecution "true"
Use the values true | false to define real-time threats due to privilege escalation risk.
Example
Show assets with privilege escalation threat
finding.vulnerability.threatIntel.isPrivilegeEscalation:"true"
finding.vulnerability.threatIntel.isRansomwarefinding.vulnerability.threatIntel.isRansomware
Use the values true | false to define real-time threats due to ransomeware vulnerability.
Example
Show assets with ransomeware threat
finding.vulnerability.threatIntel.isRansomware:"true"
Use the values true | false to filter real-time threats due to Solorigate/Sunburst risk.
Example
Show assets with Solorigate/Sunburst threat
finding.vulnerability.threatIntel.isSolorigateSunburst:"true"
Use the values true | false to define real-time threats due to CISA Exploits.
Examples
Show assets with threats due to CISA exploit
finding.vulnerability.threatIntel.isCisaKnownExploitedVuln:true
Show assets that don't have threats due to CISA exploit
finding.vulnerability.threatIntel.isCisaKnownExploitedVuln:false
finding.detectionSource.namefinding.detectionSource.name
Use quotes or backticks within values to help you find the source that detected the vulnerability. Understanding the origin of vulnerability data is essential for grasping the detection's context, reliability, and scope.
Examples
Show findings with Qualys as the detection source
finding.detectionSource.name:AZURE
Show findings that contain parts of the detection source
finding.detectionSource.name:"CAR Agent"
Show findings that match the exact value Qualys
finding.detectionSource.name:`Cloud Agent`
finding.riskFactor.isCisaKnownExploitfinding.riskFactor.isCisaKnownExploit
Use this token to get the list of QIDs impacted due to CISA Known Exploits. The token uses true or false as the input value.
Example
List the QIDs that are impacted due to CISA Known Exploit
finding.riskFactor.isCisaKnownExploit:TRUE
finding.riskFactor.exploitCodeMaturityfinding.riskFactor.exploitCodeMaturity
Use this token to get the list of QIDs that can be exploited based on the existing state of exploit techniques and code availability.
From the drop-down, select the name of an exploit technique:
poc, weaponized
Example
List the QIDs exploited by Weaponized exploit code maturity technique
finding.riskFactor.exploitCodeMaturity:"weaponized"
finding.riskFactor.exploitTypefinding.riskFactor.exploitType
Use string as an input value to get the list of QIDs based on the type of exploits and its related vulnerabilities.
Example
List the QIDs that are exploited whose target vulnerabilities are in web applications
finding.riskFactor.exploitType:"webapps"
finding.riskFactor.exploitType:"shellcode"
finding.riskFactor.exploitType:"remote"
finding.riskFactor.malwareNamefinding.riskFactor.malwareName
Use string as an input value to get the list of QIDs that are impacted by the malware name.
Example
List the QIDs that are impacted by the malware name TROJ_PDFKA.DQ
finding.riskFactor.malwareName:"TROJ_PDFKA.DQ"
finding.riskFactor.rtifinding.riskFactor.rti
Use this token to get the list of QIDs with Real-Time Threat Indicators (RTI) related vulnerabilities.
Example
associatedIDs that are assoicated with the Denial_of_Service Real-Time Threat Indicator
finding.riskFactor.rti:"Denial_of_Service"
finding.riskFactor.threatActorNamefinding.riskFactor.threatActorName
Use string as an input value to get the list of QIDs that are impacted by the threat actor.
Example
List the QIDs that are impacted by the threat actor name Labyrinth Chollima
finding.riskFactor.threatActorName:"Labyrinth Chollima"
List the QIDs that are impacted by the threat actor name Insiders
finding.riskFactor.threatActorName:"Insiders"
List the QIDs that are impacted by the threat actor name Senstive Information
finding.riskFactor.threatActorName:"senstive information"
List the QIDs that are impacted by the threat actor name Script Kiddies
finding.riskFactor.threatActorName:"Script kiddies"
finding.vulnerability.cveIdfinding.vulnerability.cveId
Use a text value to find the CVE name.
Example
Show findings with CVE name CVE-2015-0313
finding.vulnerability.cveId:CVE-2015-0313
The CVE in the query is case sensitive and must be used in capital case.
finding.vulnerability.cvss2BaseScorefinding.vulnerability.cvss2BaseScore
Use an integer value to help you find the CVSS2 base score.
Example
Show assets with this score
finding.vulnerability.cvss2BaseScore:7.8
finding.vulnerability.cvss3BaseScorefinding.vulnerability.cvss3BaseScore
Use an integer value to find the CVSSv3.1 base score.
Example
Show assets with this score
finding.vulnerability.cvss3BaseScore:7.8
finding.vulnerability.mitre.attack.tactic.idfinding.vulnerability.mitre.attack.tactic.id
Use the text value within quotes or backticks for the tactics id that represents the why of the ATT&CK technique or sub-technique.
Example
Show findings with the Tactic ID TA0007
finding.vulnerability.mitre.attack.tactic.id:`TA0007`
finding.vulnerability.mitre.attack.technique.idfinding.vulnerability.mitre.attack.technique.id
Use the text value within quotes or backticks for the technique id that represents how a tactical goal can be achieved.
Example
Show findings with the Technique ID T1562.010
finding.vulnerability.mitre.attack.technique.id:"T1562.010"
finding.vulnerability.isPCIfinding.vulnerability.isPCI
Use the values true | false to find vulnerabilities that must be fixed for PCI Compliance (per PCI DSS).
Examples
Show PCI vulnerabilities
finding.vulnerability.isPCI:TRUE
Do not show PCI vulnerabilities
finding.vulnerability.isPCI:FALSE
finding.vulnerability.ransomware.namefinding.vulnerability.ransomware.name
Use quotes or backticks within values to help you find the ransomware name you're looking for. Quotes can be used when the value has more than one word.
Examples
Show findings with this name
finding.vulnerability.ransomware.name:Locky
Show findings that match exact value
finding.vulnerability.ransomware.name:Locky
finding.vulnerability.severityfinding.vulnerability.severity
Use an integer value to view the severity level set by Qualys to find assets having vulnerabilities. The severity level ranges between 1-5. Select from values in the drop-down menu.
Example
Show findings with severity set by Qualys as 5
finding.vulnerability.severity:5
For information about customer and Qualys severity, see Customer and Kb Severity Level.
finding.isQualysMitigablefinding.isQualysMitigable
Use the values true | false to indicate whether Qualys can mitigate a detected vulnerability.
Example
Show findings with vulnerabilities that can be mitigated
finding.isQualysMitigable:TRUE
This QQL is dependent on other modules. To use this QQL, ensure that all prerequisites are met.
Patch Management v3.0.0 and higher | Mitigation - v3.0 | ARSC Services - v1.10.0
finding.isQualysPatchablefinding.isQualysPatchable
Use the values true | false to indicate whether Qualys can patch a detected vulnerability.
Example
Show findings with vulnerabilities that can be patched
finding.isQualysPatchable:TRUE