Searching Assets
Syntax help displayed in UI for Asset tokens. A complete list of tokens for writing search queries is provided below. Click each token to learn more about it.
accounts.usernameaccounts.username
Use an text value ##### to help you find an account username you're looking for.
Example
Show findings with username administrator
accounts.username:administrator
Use an integer value ##### to help you find systems with a Qualys asset ID of interest.
Example
Show findings with this asset ID
asset.assetID:122855563
Use values within quotes or backticks to help you find the asset name you're looking for.
Examples
Show any findings that contain parts of name
asset.name:"ACMENVT7"
Show any findings that match exact value "QK2K12QP3-65-53"
asset.name:`ACMENVT7`Type your
drop-down text here.
Use values within quotes or backticks to help you find the asset tag you're looking for.
Examples
Show any findings that contain "network" and "blue" in name
asset.tag: "network blue"
Show any findings that contain "network" or "blue" in name (another method)
asset.tag: "network" OR asset.tag:
blue"
Show any findings that match exact value "Cloud Agent"
asset.tag: `Cloud Agent`
Use a text value ##### in quotes to find assets with a certain timezone set.
Example
Show assets with this timezone
asset.timezone:"-08:00"
asset.totalMemoryasset.totalMemory
Use an integer value ##### to help you find assets with a certain total system memory (GB).
Example
Show assets with this total system memory
asset.totalMemory:1024
Use a text value ##### in quotes to find assets with a certain status.
Example
Show enrolled assets
asset.status:"Enrolled"
Use an integer value ##### in quotes to help you find assets with of a certain type (Android Phone, Android Tablet, iPad, iPhone, iPod Touch).
Example
Show assets of type iPad
asset.type:"iPad"
inventory.createdinventory.created
Use a date range or specific date to define when assets were created (i.e. when assets were enrolled).
Examples
Show assets created within certain dates
inventory.created:[2018-01-01 ... 2018-01-10]
Show assets created starting 2017-10-01, ending 1 month ago
inventory.created:[2017-10-01 ... now-1M]
Show assets created starting 2 weeks ago, ending 1 second ago
inventory.created:[now-2w ... now-1s]
Show assets created on specific date
inventory.created:'2016-05-23'
inventory.lastUpdatedinventory.lastUpdated
Use a date range or specific date to define when assets were updated (i.e. when asset data was uploaded to the Qualys Cloud Platform by an agent).
Examples
Show assets updated within certain dates
inventory.lastUpdated: [2018-01-01 ... 2018-01-10]
Show assets updated starting 2017-06-01, ending 3 months ago
inventory.lastUpdated: [2017-06-01 ... now-3M]
Show assets updated starting 2 weeks ago, ending 1 second ago
inventory.lastUpdated: [now-2w ... now-1s]
Show assets updated on a specific date
inventory.lastUpdated:'2018-01-22'
Use an integer value ##### to find an asset with the IMEI number.
Example
Show asset with this IMEI number
asset.imei:359869061132382
asset.batteryLevelasset.batteryLevel
Use an integer value ##### to find assets with a certain battery level (%).
Example
Show assets with this battery level
asset.batteryLevel:30
Use a date range or specific date to define when assets were last seen or successfully connected to the Qualys Cloud Platform.
Examples
Show assets last seen within certain dates
asset.lastSeen: [2018-01-01 ... 2018-01-10]
Show assets last seen starting 2017-06-01, ending 3 months ago
asset.lastSeen: [2017-06-01 ... now-3M]
Show assets last seen starting 2 weeks ago, ending 1 second ago
asset.lastSeen: [now-2w ... now-1s]
Show assets last seen on a specific date
asset.lastSeen:'2018-01-22'
Use a text value ##### in quotes to find an asset with the UDID number.
Example
Show asset with this UDID number
asset.udid:"528B4335101D58B0E5E6BF9B5EAB1D4CA87E9372"
asset.ownershipasset.ownership
Use a text value ##### in quotes to find assets with a certain ownership.
Example
Show corporate owned assets
asset.ownership:"Corporate Owned"
asset.internalStorageEncryptionasset.internalStorageEncryption
Use a text value ##### in quotes to find assets with a certain encryption status (No Encryption, Encryption Complete, Active, Inactive, Unsupported, Block-level encryption enabled, File-level encryption enabled, Data Protection enabled ).
Example
Show assets with no internal storage encryption
asset.internalStorageEncryption:"No Encryption"
asset.mobileNumberasset.mobileNumber
Use values within quotes or backticks to find assets with a certain mobile number.
Examples
Find assets with parts of mobile number
asset.mobileNumber: "95744730"
Find assets that match exact value
asset.mobileNumber: `9527473047`
asset.isRoamingONasset.isRoamingON
Use the values Yes | No in quotes to find assets with a certain roaming status.
Example
Show assets with this roaming status
asset.isRoamingON: "Yes"
asset.isDataRoamingONasset.isDataRoamingON
Use the values Yes | No in quotes to find assets with a certain data roaming status.
Example
Show assets with this data roaming status
asset.isDataRoamingON: "Yes"
asset.isVoiceRoamingONasset.isVoiceRoamingON
Use the values Yes | No in quotes to find assets with a certain voice roaming status.
Example
Show assets with this voice roaming status
asset.isVoiceRoamingON: "Yes"
asset.currentMobileNetworkCodeasset.currentMobileNetworkCode
Use a text value ##### in quotes to find assets with a certain current mobile network code.
Example
Show assets with this current mobile network code
asset.currentMobileNetworkCode:"30"
asset.currentMobileCountryCodeasset.currentMobileCountryCode
Use a integer value ##### to find assets with a certain current mobile country code.
Example
Show assets with this current mobile country code
asset.currentMobileCountryCode:404
asset.simCarrierNetworkasset.simCarrierNetwork
Use values within quotes or backticks to find assets with a SIM carrier network of interest.
Examples
Find assets of this SIM carrier network
asset.simCarrierNetwork: Vodafone IN
Find assets with parts of SIM carrier network
asset.simCarrierNetwork: "Vodafone"
Find assets that match exact value
asset.simCarrierNetwork: `Vodafone IN`
asset.subscriberCarrierNetworkasset.subscriberCarrierNetwork
Use values within quotes or backticks to find assets with a subscriber carrier network of interest.
Examples
Find assets of this subscriber carrier network
asset.subscriberCarrierNetwork: Vodafone IN
Find assets with parts of subscriber carrier network
asset.subscriberCarrierNetwork: "Vodafone"
Find assets that match exact value
asset.subscriberCarrierNetwork: `Vodafone IN`
Use a integer value ##### to find assets with a certain SIM ICCID.
Example
Show assets with this SIM ICCID
asset.simICCID:89310410106543789301
asset.cellularIPAddressasset.cellularIPAddress
Use a text value ##### to find assets with a certain cellular IP address.
Example
Show assets with this cellular IP address
asset.cellularIPAddress:192.168.248.70
asset.wifiIPAddressasset.wifiIPAddress
Use a text value ##### to find assets with a certain Wi-Fi IP address.
Example
Show assets with this Wi-Fi IP address
asset.wifiIPAddress:192.168.248.70
Use a text value ##### to find assets with a certain Wi-Fi MAC address.
Example
Show assets with this Wi-Fi MAC address
asset.wifiMAC:DC:E8:38:67:BC:A9
asset.bluetoothMACasset.bluetoothMAC
Use a text value ##### to find assets with a certain Bluetooth MAC address.
Example
Show assets with this Bluetooth MAC address
asset.bluetoothMAC:DC:E8:38:66:36:09
asset.isLocationServicesONasset.isLocationServicesON
Use the values Yes | No in quotes to find assets with a certain location services status.
Example
Show assets with this location services status
asset.isLocationServicesON: "Yes"
asset.isPasscodePresentasset.isPasscodePresent
Use the values Yes | No in quotes to find assets with a certain passcode status.
Example
Show assets on which the pass code is set
asset.isPasscodePresent: "Yes"
asset.qagentVersionasset.qagentVersion
Use a text value ##### to find assets with a certain QAgent version.
Example
Show assets with this QAgent version
asset.qagentVersion:"1.0"
asset.knoxVersionasset.knoxVersion
Use a text value ##### to find assets with a certain Knox version.
Example
Show assets with this Knox version
asset.knoxVersion:"1.0"
asset.isUsbDebuggingONasset.isUsbDebuggingON
Use the values Yes | No in quotes to find assets with a certain USB Debugging status.
Example
Show assets with this USB debugging setting
asset.isUsbDebuggingON: "Yes"
asset.isDeveloperOptionsONasset.isDeveloperOptionsON
Use the values Yes | No in quotes to find assets with a certain Developer Options status.
Example
Show assets with this Developer Options setting
asset.isDeveloperOptionsON: "Yes"
asset.isUnknownSourcesONasset.isUnknownSourcesON
Use the values Yes | No in quotes to find assets with a certain unknown source setting.
Example
Show assets enabled for installing apps from unknown source
asset.isUnknownSourcesON: "Yes"
asset.isBluetoothONasset.isBluetoothON
Use the values Yes | No in quotes to find assets with a certain Bluetooth setting.
Example
Show assets with this Bluetooth setting
asset.isBluetoothON: "Yes"
asset.mockLocationasset.mockLocation
Use a text value ##### in quotes to find assets with a certain Mock Location status (On, Off, Possibly On).
Example
Show assets enabled for mock location
asset.mockLocation:"On"
asset.isTimeAndDateAutoUpdateONasset.isTimeAndDateAutoUpdateON
Use the values Yes | No in quotes to find assets with a certain Time And Date Auto Update setting.
Example
Show assets with this time and date auto update setting
asset.isTimeAndDateAutoUpdateON: "Yes"
asset.isActivationLockONasset.isActivationLockON
Use the values Yes | No in quotes to find assets with a certain Activation Lock setting.
Example
Show assets with this activation lock setting
asset.isActivationLockON: "Yes"
asset.isICloudBackupONasset.isICloudBackupON
Use the values Yes | No in quotes to find assets with a certain icloud backup setting.
Example
Show assets with this iCloud backup setting
asset.isICloudBackupON: "Yes"
asset.isSupervisedasset.isSupervised
Use the values Yes | No in quotes to find assets with a certain supervised setting.
Example
Show assets with supervised mode enabled
asset.isSupervised: "Yes"
asset.ethernetMACasset.ethernetMAC
Use a text value ##### in quotes to find assets with a certain Ethernet MAC address.
Example
Show assets with this Ethernet MAC address
asset.ethernetMAC:5A-00-56-A9-53-7A
asset.isIOSUpdateAvailableasset.isIOSUpdateAvailable
Use the values Yes | No in quotes to find assets for which iOS update is available.
Example
Show assets for which iOS update is available
asset.isIOSUpdateAvailable: "Yes"
Use a date range or specific date to define when assets were imported to the Qualys Cloud Platform.
Examples
Show assets imported within certain dates
asset.imported: [2018-01-01 ... 2018-01-10]
Show assets imported starting 2017-06-01, ending 3 months ago
asset.imported: [2017-06-01 ... now-3M]
Show assets imported starting 2 weeks ago, ending 1 second ago
asset.imported: [now-2w ... now-1s]
Show assets imported on a specific date
asset.imported:'2018-01-22'
Use a text value ##### in quotes to find assets with a certain serial number.
Example
Show assets with this serial number
asset.serial#:"8e3b97fd0804"
Use a text value ##### in quotes to find assets with a certain mode (Active, Inactive).
Example
Show active assets
asset.mode:"Active"
Use a text value ##### in a quotes to find the assets with the APNs name you're looking for.
Example
Show assets with this APNs Name
asset.apnsName:"Demo Certificate"
asset.job.statusasset.job.status
Use a text value ##### to find jobs with certain status (Pending, Success, and Skipped).
Example
Find assets with this job status.
asset.job.status:Pending
hardware.manufacturerhardware.manufacturer
Use values within quotes or backticks to help you find the hardware manufacturer you're looking for.
Examples
Show any findings with this hardware manufacturer
hardware.manufacturer: Dell
Show any findings that contain components of hardware manufacturer name
hardware.manufacturer: "Dell"
Show any findings that match exact value
hardware.manufacturer: `Dell`
hardware.producthardware.product
Use values within quotes or backticks to help you find the hardware product you're looking for.
Examples
Show any findings with this hardware product
hardware.product: Latitude
Show any findings that contain components of hardware product name
hardware.product: "Latitude"
Show any findings that match exact value
hardware.product: `Latitude`
Use values within quotes or backticks to help you find the hardware model you're looking for.
Examples
Show any findings with this hardware model
hardware.model: De7470
Show any findings that contain components of hardware model name
hardware.model: "De7470"
Show any findings that match exact value
hardware.model: `De7470`
application.isSystemAppapplication.isSystemApp
Use the values Yes | No in quotes to find system applications.
Example
Show system applications
application.isSystemApp: "Yes"
application.nameapplication.name
Use values within quotes or backticks to help you find the applications you're looking for.
Examples
Show any findings with this application version
application.name: ES File Explorer
Show any findings that contain components of application name
application.name: "ES File Explorer"
Show any findings that match exact value
application.name: `ES File Explorer`
application.versionapplication.version
Use values within quotes or backticks to help you find the application version you're looking for.
Examples
Show any findings with this application version
application.version: 4.1.9.7.4
Show any findings that contain components of application version
application.version: "4.1.9.7.4"
Show any findings that match exact value
application.version: `4.1.9.7.4`
application.versionCodeapplication.versionCode
Use a text value ##### in quotes to find applications with certain version code.
Example
Show applications of this version code
application.versionCode:"20"
application.installedOnapplication.installedOn
Use a date range or specific date to define when applications were installed.
Examples
Show applications installed within certain dates
application.installedOn: [2018-01-01 ... 2018-01-10]
Show applications installed starting 2017-06-01, ending 3 months ago
application.installedOn: [2017-06-01 ... now-3M]
Show applications installed starting 2 weeks ago, ending 1 second ago
application.installedOn: [now-2w ... now-1s]
Show applications installed on a specific date
application.installedOn:'2018-01-22'
application.tagapplication.tag
Use values within quotes or backticks to help you find the application with certain tag.
Examples
Show any applications with this tag
application.tag: Business
Show any applications that contain components of tag name
application.tag: "Business"
Show any application tags that match exact value
application.tag: `Business`
application.usesMockLocationapplication.usesMockLocation
Use the values Yes | No in quotes to find applications that use mock location.
Example
Show applications that use mock location
application.usesMockLocation: "Yes"
application.identifierapplication.identifier
Use a text value ##### in quotes to define the application identifier you are interested in.
Example
Show findings with this application identifier
application.identifier:"com.facebook.katana"
Use a text value ##### in a quotes to find the user with username you're looking for.
Example
Show findings with this username
user.username:"administrator"
user.eula.statususer.eula.status
Use a text value ##### in quotes to find users with certain EULA status (Pending, Accepted, Declined).
Example
Show users with pending EULA
user.eula.status:"Pending"
Use a text value ##### in quotes to find users with a certain status (Active, Inactive).
Example
Show active users
user.status:"Active"
auditLogs.portalUsedauditLogs.portalUsed
Use a text value ##### in quotes to find operations performed on a certain portal (Web Portal, Enrollment Portal).
Example
Show operations performed on the Web Portal
auditLogs.portalUsed:"Web Portal"
Use a text value ##### in a quotes to find the APNs certificates with the status you're looking for.
Example
Show APNs certificates with this status
apns.status:"Expired"
asset.isVulnerableasset.isVulnerable
Use a text value ##### to find assets which are vulnerable.
Example
Show assets which are vulnerable
asset.isVulnerable:"Yes"
asset.androidSecurityPatchLevelasset.androidSecurityPatchLevel
Use a date range or specific date to find the assets you are looking for.
Examples
Show assets which have Security Patch Level within certain dates
asset.androidSecurityPatchLevel: [2019-06-01 ...
2019-12-02]
Show assets which have Security Patch Level with a specific date
asset.androidSecurityPatchLevel:'2019-12-01'
asset.chromeSecurityPatchLevelasset.chromeSecurityPatchLevel
Use a date range or specific date to find the assets you are looking for.
Examples
Show assets which have Security Patch Level within certain dates
asset.chromeSecurityPatchLevel: [2019-06-01 ...
2019-12-02]
Show assets which have Security Patch Level with a specific date
asset.chromeSecurityPatchLevel:'2019-12-01'
asset.kernelVersionasset.kernelVersion
Use a text value ##### to define the Kernel version you're interested in.
Example
Show findings with this Kernel version
asset.kernelVersion:"4.4.78-perf+"
asset.isWiFiHotspotONasset.isWiFiHotspotON
Use a text value ##### in a quotes to find the asset with Wi-Fi Hotspot status you're looking for.
Example
Show assets with this Wi-Fi Hotspot status
asset.isWiFiHotspotON:"Yes"
asset.isConnectedToOpenWiFiasset.isConnectedToOpenWiFi
Use the values Yes | No in quotes to find assets which are connected to Open Wi-Fi network.
Example
Show assets connected to open Wi-Fi network
asset.isConnectedToOpenWiFi:"Yes"
asset.isPlayProtectEnabledasset.isPlayProtectEnabled
Use a text value ##### in a quotes to find the asset with Play Protected status you're looking for.
Example
Show assets for which Play Protect is not enabled
asset.isPlayProtectEnabled:"No"
asset.isPotentialHarmfulAppsPresentasset.isPotentialHarmfulAppsPresent
Use a text value ##### in a quotes to find the asset with Potential Harmful Apps Present status you're looking for.
Example
Show assets for which Potential Harmful Apps Present is enabled
asset.isPotentialHarmfulAppsPresent:"Yes"
application.hasUpdateAvailableapplication.hasUpdateAvailable
Use a text value ##### to find applications for which update is available
Example
Show applications for which update is available
application.hasUpdateAvailable:"Yes"
vulnerabilities.foundvulnerabilities.found
Use the values true | false to define vulnerabilities are detected or not on the asset.
Example
Show findings with vulnerabilities detected
vulnerabilities.found:true
vulnerabilities.lastFoundvulnerabilities.lastFound
Use a date range or specific date to define when findings were last found.
Examples
Show findings last found within certain dates
vulnerabilities.lastFound: [2019-01-10 ... 2019-06-01]
Show findings last found starting 2010-06-01, ending 1 month ago
vulnerabilities.lastFound: [2019-01-10 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
vulnerabilities.lastFound: [now-2w ... now-1s]
Show findings last found on a specific date
vulnerabilities.lastFound:'2019-07-15'
vulnerabilities.severityvulnerabilities.severity
Use an integer value ##### to find vulnerabilities with this severity (1-5). Select from values in the drop-down menu.
Example
Show findings with severity 5
vulnerabilities.severity:5
vulnerabilities.statusvulnerabilities.status
Use a text value ##### to find vulnerabilities with certain status (e.g. Active, Fixed, New, Reopened). Select from names in the drop-down menu.
Example
Show vulnerabilities with New status
vulnerabilities.status:New
vulnerabilities.typeDetectedvulnerabilities.typeDetected
Use a text value ##### to find assets with vulnerabilities of the specified detection type (e.g. Confirmed, Potential, Information). Select from names in the drop-down menu.
Example
Show vulnerabilities with detection type Confirmed
vulnerabilities.typeDetected:Confirmed
vulnerabilities.vulnerability.qidvulnerabilities.vulnerability.qid
Use an integer value ##### to show vulnerabilities with the defined QIDs.
Example
Show vulnerabilities with QID 90405
vulnerabilities.vulnerability.qid:90405
vulnerabilities.vulnerability.categoryvulnerabilities.vulnerability.category
Use a text value ##### to show vulnerabilities with the defined category.
Example
Show findings with category Android
vulnerabilities.vulnerability.category:Android
vulnerabilities.vulnerability.titlevulnerabilities.vulnerability.title
Use values within quotes or backticks to help you find the title you're looking for.
Examples
Show any findings related to this title
vulnerabilities.vulnerability.title: Remote Code
Execution
Show any findings that contain "Remote" or "Code" in title
vulnerabilities.vulnerability.title: "Remote
Code"
Show any findings that match exact value "Remote Code"
vulnerabilities.vulnerability.title: `Remote Code`
vulnerabilities.firstFoundvulnerabilities.firstFound
Use a date range or specific date to define when findings were first found.
Examples
Show findings first found within certain dates
vulnerabilities.firstFound: [2019-01-10 ... 2019-06-01]
Show findings first found starting 2010-06-01, ending 1 month ago
vulnerabilities.firstFound: [2019-01-10 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
vulnerabilities.firstFound: [now-2w ... now-1s]
Show findings first found on a specific date
vulnerabilities.firstFound:'2019-07-15'
vulnerabilities.assetNamevulnerabilities.assetName
Use values within quotes or backticks to help you find the asset name you're looking for.
Examples
Show any findings related to this name
vulnerabilities.assetName: Admin_Android_Samsung
Show any findings that contain parts of this name
vulnerabilities.assetName: "Samsung"
Show any findings that match exact value "Admin_Android_Samsung"
vulnerabilities.assetName: `Admin_Android_Samsung`
vulnerabilities.assetOSvulnerabilities.assetOS
Use values within quotes or backticks to help you find the asset operating system you're looking for.
Examples
Show any findings with this OS name
vulnerabilities.assetOS: Android
Show any findings that contain parts of OS name
vulnerabilities.assetOS: "Android"
Show any findings that match exact value "Android"
vulnerabilities.assetOS: `Android`
vulnerabilities.vulnerability.cveidsvulnerabilities.vulnerability.cveids
Use a text value ##### to find the CVE name you're interested in.
Example
Show findings with CVE name CVE-2015-0313
vulnerabilities.vulnerability.cveids:CVE-2015-0313
vulnerabilities.vulnerability.cvss3Info.baseScorevulnerabilities.vulnerability.cvss3Info.baseScore
Use an integer value ##### to help you find the CVSSv3 base score you're interested in.
Example
Show assets with 7.8 basescore
vulnerabilities.vulnerability.cvss3Info.baseScore:7.8
Use an integer value ##### to help you find assets with the CVSSv3 temporal score you're interested in.
Example
Show assets with 6.4 temporal score
vulnerabilities.vulnerability.cvss3Info.temporalScore:6.4
Use a text value ##### to help you find assets with the CVSS access vector you're interested in (e.g. Undefined, Local_access, Adjacent_network, Network). Select from names in the drop-down menu.
Example
Show assets with this name
vulnerabilities.vulnerability.cvssInfo.accessVector:Network
vulnerabilities.vulnerability.cvssInfo.baseScorevulnerabilities.vulnerability.cvssInfo.baseScore
Use an integer value ##### to help you find the CVSS base score you're interested in.
Example
Show assets with 7.8 basescore
vulnerabilities.vulnerability.cvssInfo.baseScore:7.8
Use an integer value ##### to help you find assets with the CVSS temporal score you're interested in.
Example
Show assets with 6.4 temporal score
vulnerabilities.vulnerability.cvssInfo.temporalScore:6.4
vulnerabilities.vulnerability.descriptionvulnerabilities.vulnerability.description
Use values within quotes or backticks to help you find the description you're looking for.
Examples
Show any findings related to this description
vulnerabilities.vulnerability.description: Remote
Code Execution
Show any findings that contain "Remote" or "Code" in description
vulnerabilities.vulnerability.description: "Remote
Code"
Show any findings that match exact value "Remote Code"
vulnerabilities.vulnerability.description: `Remote
Code`
vulnerabilities.vulnerability.osvulnerabilities.vulnerability.os
Use values within quotes or backticks to help you find the operating system the vulnerabilities were detected on.
Examples
Show any findings with this OS name
vulnerabilities.vulnerability.os: Windows
Show any findings that contain parts of OS name
vulnerabilities.vulnerability.os: "Windows"
Show any findings that match exact value "Windows"
vulnerabilities.vulnerability.os: `Windows`
vulnerabilities.vulnerability.publishedvulnerabilities.vulnerability.published
Use a date range or specific date to define when vulnerabilities were first published in the KnowledgeBase.
Examples
Show findings for vulnerabilities published within certain dates
vulnerabilities.vulnerability.published: [2019-01-10
... 2019-06-01]
Show findings for vulnerabilities published starting 2017-01-01, ending 1 month ago
vulnerabilities.vulnerability.published: [2019-01-10
... now-1M]
Show findings for vulnerabilities published starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.published: [now-2w
... now-1s]
Show findings for vulnerabilities published on certain date
vulnerabilities.vulnerability.published:'2019-07-15'
vulnerabilities.vulnerability.solutionvulnerabilities.vulnerability.solution
Use values within quotes or backticks to help you find the solution you're looking for.
Examples
Show any findings related to this solution
vulnerabilities.vulnerability.solution: Bulletin
MS10-006
Show any findings that contain parts of solution
vulnerabilities.vulnerability.solution: "Bulletin
MS10-006"
Show any findings that match exact value "Bulletin MS10-006"
vulnerabilities.vulnerability.solution: `Bulletin
MS10-006`
vulnerabilities.vulnerability.updatedvulnerabilities.vulnerability.updated
Use a date range or specific date to define when vulnerabilities were updated in the KnowledgeBase.
Examples
Show vulnerabilites updated within certain dates
vulnerabilities.vulnerability.updated: [2019-01-10
... 2019-06-01]
Show vulnerabilites updated starting 2010-06-01, ending 1 month ago
vulnerabilities.vulnerability.updated: [2019-01-10
... now-1M]
Show vulnerabilites updated starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.updated: [now-2w
... now-1s]
Show vulnerabilites updated on certain date
vulnerabilities.vulnerability.updated:'2019-07-15'
vulnerabilities.vulnerability.vendorRefsvulnerabilities.vulnerability.vendorRefs
Use a text value ##### to help you find the vendor reference you're interested in.
Example
Show vendors with this reference value
vulnerabilities.vulnerability.vendorRefs:KB3021953
vulnerabilities.vulnerability.vendors.productNamevulnerabilities.vulnerability.vendors.productName
Use a text value ##### to help you find the vendor product name you're interested in.
Example
Show findings with this vendor product name
vulnerabilities.vulnerability.vendors.productName:Android
vulnerabilities.vulnerability.vendors.vendorNamevulnerabilities.vulnerability.vendors.vendorName
Use a text value ##### to help you find the vendor name you're interested in.
Example
Show findings with this vendor name
vulnerabilities.vulnerability.vendors.vendorName:Google
vulnerabilities.vulnerability.riskvulnerabilities.vulnerability.risk
Use a text value ##### to help you define the vulnerability risk rating you're interested in. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
vulnerabilities.vulnerability.risk:50
vulnerabilities.vulnerability.supportedByvulnerabilities.vulnerability.supportedBy
Use a text value ##### to select a Qualys service (SEM-Android and SEM-IOS) to show vulnerabilities that can be detected by this service. Select from names in the drop-down menu.
Example
Show vulnerabilities supported by SEM-Android
vulnerabilities.vulnerability.supportedBy:SEM-Android
vulnerabilities.vulnerability.consequencevulnerabilities.vulnerability.consequence
Use values within quotes or backticks to help you find the consequence you're looking for.
Examples
Show any findings related to consequence
vulnerabilities.vulnerability.consequence: sensitive
information
Show any findings that contain "sensitive" or "information" in consequence
vulnerabilities.vulnerability.consequence: "sensitive
information"
Show any findings that match exact value "sensitive information"
vulnerabilities.vulnerability.consequence: `sensitive
information`
vulnerabilities.isPatchablevulnerabilities.isPatchable
Use the values Yes | No in quotes to find the patchable vulnerabilities.
Example
Show patchable vulnerabilities
vulnerabilities.isPatchable:"Yes"
asset.locationServicesStatusChangedOnasset.locationServicesStatusChangedOn
Use a date range or specific date to define when assets location services status was changed.
Examples
Show assets whose location services status was changed within certain dates
asset.locationServicesStatusChangedOn: [2021-01-01
... 2021-01-02]
Show assets whose location services status was changed starting 2 weeks ago, ending 1 second ago
asset.locationServicesStatusChangedOn: [now-2w
... now-1s]
Show assets whose location services status was changed on a specific date
asset.locationServicesStatusChangedOn: '2019-02-01'
vulnerabilities.vulnerability.cve.severityvulnerabilities.vulnerability.cve.severity
Select a severity (1-5) to find CVE with this severity. Select from values in the drop-down menu
Examples
Show findings with severity 5
vulnerabilities.vulnerability.cve.severity: '5'
vulnerabilities.vulnerability.releasedOnvulnerabilities.vulnerability.releasedOn
Use a date range or specific date to define when Security update or QID is released.
Examples
Show Security update or QID released within certain dates
vulnerabilities.vulnerability.releasedOn: [2021-01-01
... 2021-01-02]
Show Security update or QID released starting 2018-06-01, ending 3 months ago
vulnerabilities.vulnerability.releasedOn: [2020-04-01
... now-3M]
Show Security update or QID released starting 2 weeks ago, ending 1 second ago
vulnerabilities.vulnerability.releasedOn: [now-2w
... now-1s]
Show assets whose location services status was changed on a specific date
Show Security update or QID released on a specific date
vulnerabilities.vulnerability.releasedOn:'2019-02-01'
vulnerabilities.vulnerability.typevulnerabilities.vulnerability.type
Use a text value ##### in quotes to find the vulnerabilities with certain type.
Example
Show vulnerabilites of OS type
vulnerabilities.vulnerability.type:"OS"
application.hash.MD5application.hash.MD5
Use a text value ##### in quotes to define the MD5 hash of a application file you're interested in.
Example
Show application with this MD5 hash
application.hash.MD5:"9a07d92b04afccabca93bc9279aefdcb"
application.hash.SHA1application.hash.SHA1
Use a text value ##### in quotes to define the SHA1 hash of a application file you're interested in.
Example
Show application with this SHA1 hash
application.hash.SHA1:"3ff09b5f0429448ae92db6abba04a94240183f83"
application.hash.SHA256application.hash.SHA256
Use a text value ##### in quotes to define the SHA256 hash of a application file you're interested in.
Example
Show application with this SHA256 hash
application.hash.SHA256:"589037f6c2b837128383756910f6e2901c7577e4bfb16597ae22d045d94f225a"
application.installationSourceapplication.installationSource
Use a text value ##### in quotes to find the applications with a certain installation source.
Example
Show applications with this installation source
application.installationSource:"Unknown"
application.isInstalledViaAppleAppStoreapplication.isInstalledViaAppleAppStore
Use the values Yes | No in quotes to find applications which are or not installed via Apple App Store
Example
Show applications which are not installed via Apple App Store
application.isInstalledViaAppleAppStore:"Yes"
application.isPotentialHarmfulAppapplication.isPotentialHarmfulApp
Use the values Yes | No in quotes to find applications which are or not Potential Harmful Apps
Example
Show applications which are Potential Harmful
application.isPotentialHarmfulApp:"Yes"
application.isBatteryOptimizationEnabledapplication.isBatteryOptimizationEnabled
Use the values Yes | No in quotes to find applications for which the battery optimization is enabled or not
Example
Show applications for which the battery optimization is enabled
application.isBatteryOptimizationEnabled:"Yes"
application.isScreenReaderEnableapplication.isScreenReaderEnable
Use the values Yes | No in quotes to find applications for which the screen reader is enabled or not
Example
Show applications with screen reader enabled
application.isScreenReaderEnable:"Yes"
application.canRequestScreenReaderapplication.canRequestScreenReader
Use the values Yes | No in quotes to find applications which can raise request for screen reader or not
Example
Show applications which can request for screen reader
application.canRequestScreenReader:"Yes"
application.canRequestDeviceAdministratorapplication.canRequestDeviceAdministrator
Use the values Yes | No in quotes to find applications which can raise request for device administrator or not
Example
Show applications which can request for device administrator
application.canRequestDeviceAdministrator:"Yes"
Use quotes or backticks within values to help you find jobs with certain job name.
Example
Show jobs with this job name
job.name:Facebook
Show jobs that contains part of job name
job.name:"Facebook"
Show jobs that matches exact job name
job.name:`Facebook`
Use a integer value ##### to find a certain job with job id.
Example
Show findings with this job id
job.id:123
Use a text value ##### to find a certain job with job status (Enabled, In Progress, Completed, and Disabled).
Examples
Find job with this status
job.status: Completed
job.scheduleTypejob.scheduleType
Use a text value ##### to find a certain job with job schedule type (On-demand and Once).
Examples
Find job with this schedule type
job.scheduleType: On-demand
Use a integer value ##### to find a certain job with job QID.
Examples
Find job with this QID
job.qid: 610069
Use a text value ##### to find a certain job with job CVE ID.
Examples
Find job with this CVE ID
job.cveId: CVE-2019-11931
Use a date range or specific date to define when job were created.
Examples
Show jobs created within certain dates
job.created: [2018-01-01 ... 2018-01-10]
Show jobs created starting 2017-06-01, ending 3 months ago
job.created: [2017-06-01 ... now-3M]
Show jobs created starting 2 weeks ago, ending 1 second ago
job.created: [now-2w ... now-1s]
Show jobs created on a specific date
job.created:'2018-01-22'
Use a date range or specific date to define when jobs were sent.
Examples
Show jobs sent within certain dates
job.sent: [2018-01-01 ... 2018-01-10]
Show jobs sent starting 2017-06-01, ending 3 months ago
job.sent: [2017-06-01 ... now-3M]
Show jobs sent starting 2 weeks ago, ending 1 second ago
job.sent: [now-2w ... now-1s]
Show jobs sent on a specific date
job.sent:'2018-01-22'
Use quotes or backticks within values to help you find jobs with asset tag name the job applies to.
Examples
Show any job with this asset tag name
job.tag: sanjose
Show any job that contain components of asset tag name
job.tag: "sanjose Android"
Show any job that matches exact value
job.tag: `Android-sanjose`
job.assetStatusjob.assetStatus
Use a text value ##### to find a certain job with asset status (Pending, Success, and Skipped).
Examples
Find job with this asset status
job.assetStatus:`Success`
Use an integer value ##### to show the controls with the defined CID.
Example
Show control with CID 70001
control.cid: "70001"
Use a text value ##### in quotes to find control with a certain control name.
Example
Show findings with this name
control.name: "Ensure USB Debugging is set to Disabled"
Show findings that contains part of name
control.name: "Ensure USB Debugging is set to Disabled"
control.createdBycontrol.createdBy
Use a text value #### in quotes to find certain controls which was created by a user.
Example
Show findings created by username
control.createdBy: "adminuser"
control.modifiedBycontrol.modifiedBy
Use a text value #### in quotes to find certain controls which was modified by a user.
Example
Show findings modified by username
control.modifiedBy: "adminuser"
Use a text value ##### in quotes to find policy with a certain policy name.
Example
Show findings with this policy name
policy.name: "Android Best Practices"
Show findings that contains part of name
policy.name: "Android Best Practices"
Select the control Operating Sytem you're interested in. Choose value from: Android, iOS
Example
Show control with OS Android
control.os: Android
Select the control type you're interested in. Choose value from: System Defined
Example
Show control with type System Defined
control.type:System Defined
control.createdOncontrol.createdOn
Use date range or specific date to define when controls were created.
Example
Show controls created within certain dates
control.createdOn: [2020-07-01 ... 2020-08-02]
Show controls created starting 2020-07-01, ending 3 months ago
control.createdOn:[2020-04-01 ... now-3M]
Show controls created starting 2 weeks ago, ending 1 second ago
control.createdOn: [now-2w ... now-1s]
Show controls created on a specific date
control.createdOn: '2020-07-01'
control.modifiedOncontrol.modifiedOn
Use date range or specific date to define when controls were modified.
Example
Show controls modified within certain dates
control.modifiedOn: [2020-07-01 ... 2020-08-02]
Show controls modified starting 2020-07-01, ending 3 months ago
control.modifiedOn:[2020-04-01 ... now-3M]
Show controls modified starting 2 weeks ago, ending 1 second ago
control.modifiedOn: [now-2w ... now-1s]
Show controls modified on a specific date
control.modifiedOn: '2020-07-01'
control.lastEvaluatedOncontrol.lastEvaluatedOn
Use date range or specific date to define when controls were last evaluated.
Example
Show controls last evaluated within certain dates
control.lastEvaluatedOn: [2020-07-01 ... 2020-08-02]
Show controls last evaluated starting 2020-07-01, ending 3 months ago
control.lastEvaluatedOn:[2020-04-01 ... now-3M]
Show controls last evaluated starting 2 weeks ago, ending 1 second ago
control.lastEvaluatedOn: [now-2w ... now-1s]
Show controls last evaluated on a specific date
control.lastEvaluatedOn: '2020-07-01'
control.evaluatedOncontrol.evaluatedOn
Use date range or specific date to define when controls were evaluated.
Example
Show controls evaluated within certain dates
control.evaluatedOn: [2020-07-01 ... 2020-08-02]
Show controls evaluated starting 2020-07-01, ending 3 months ago
control.evaluatedOn:[2020-04-01 ... now-3M]
Show controls evaluated starting 2 weeks ago, ending 1 second ago
control.evaluatedOn: [now-2w ... now-1s]
Show controls evaluated on a specific date
control.evaluatedOn: '2020-07-01'
control.firstEvaluatedcontrol.firstEvaluated
Use date range or specific date to define when controls were first evaluated.
Example
Show controls first evaluated within certain dates
control.firstEvaluated: [2020-07-01 ... 2020-08-02]
Show controls first evaluated starting 2020-07-01, ending 3 months ago
control.firstEvaluated:[2020-04-01 ... now-3M]
Show controls first evaluated starting 2 weeks ago, ending 1 second ago
control.firstEvaluated: [now-2w ... now-1s]
Show controls first evaluated on a specific date
control.firstEvaluated: '2020-07-01'
control.reopenedOncontrol.reopenedOn
Use date range or specific date to define when controls were reopened.
Example
Show controls reopened within certain dates
control.reopenedOn: [2020-07-01 ... 2020-08-02]
Show controls reopened starting 2020-07-01, ending 3 months ago
control.reopenedOn:[2020-04-01 ... now-3M]
Show controls reopened starting 2 weeks ago, ending 1 second ago
control.reopenedOn: [now-2w ... now-1s]
Show controls reopened on a specific date
control.reopenedOn: '2020-07-01'
Select the result you're interested in. Choose value from: Passed, Failed.
Example
Show controls that passed
control.result: Passed
Supported Boolean Operators
The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.
Use a boolean query to express your query using AND logic.
Example
asset.status: Enrolled and asset.assetID: 122855563
The asset having the ID 122855563 and with status as Enrolled is returned in the result.
Use a boolean query to express your query using NOT logic.
Example
not hardware.manufacturer:Samsung
Show assets whose manufacturer is not Samsung.
Use a boolean query to express your query using OR logic.
Example
asset.status: Enrolled or asset.status: De-enrolled
Show findings with one of these asset status.