Searching Users

Syntax help displayed in UI for User tokens. A complete list of tokens for writing search queries is provided below. Click each token to learn more about it.

user.accountuser.account

Use a text value ##### in quotes to find a certain user account name.

Example

Show findings with this user account

user.account:"adminuser"

user.usernameuser.username

Use a text value ##### in quotes to find a certain user name.

Example

Show findings with this user name

user.username:"adminuser"

user.emailuser.email

Use values within quotes or backticks to help you find users with certain email address.

Examples

Show any users with this email address

user.email: info@yourdomain.com

Show any users that contain components of email address

user.email: "info@yourdomain.com"

Show any users that match exact value

user.email: `info@yourdomain.com`

user.fullNameuser.fullName

Use values within quotes or backticks to help you find users with their full name.

Examples

Show any users with this full name

user.fullName: Support Admin

Show any users that contain components of full name

user.fullName: "Support Admin"

Show any users that match exact value

user.fullName: `Support Admin`

user.statususer.status

Use a text value ##### in quotes to find users with a certain status (Active, Inactive).

Example

Show active users

user.status:"Active"

user.typeuser.type

Use a text value ##### in quotes to find users of a certain type.

Example

Show SEM users

user.type:"SEM"

user.taguser.tag

Use values within quotes or backticks to help you find the users with certain tag.

Examples

Show any users with this tag

user.tag: Field Force

Show any users that contain components of tag name

user.tag: "Field Force"

Show any user tags that match exact value

user.tag: `Field Force`

user.eula.nameuser.eula.name

Use a text value ##### in quotes to find users associated with certain EULA.

Example

Show users associated to this EULA

user.eula.name:"System EULA"

user.eula.statususer.eula.status

Use a text value ##### in quotes to find users with certain EULA status (Pending, Accepted, Declined).

Example

Show users with pending EULA

user.eula.status:"Pending"

user.createduser.created

Use a date range or specific date to define when users were created.

Examples

Show users created within certain dates

user.created: [2018-01-01 ... 2018-01-10]

Show users created starting 2017-06-01, ending 3 months ago

user.created: [2017-06-01 ... now-3M]

Show users created starting 2 weeks ago, ending 1 second ago

user.created: [now-2w ... now-1s]

Show users created on a specific date

user.created:'2018-01-22'

Supported Boolean Operators

The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.

andand

Use a boolean query to express your query using AND logic.

Example

user.status: Active and user.username: "adminuser"

Find user with this username and user status.

notnot

Use a boolean query to express your query using NOT logic.

Example

not user.eula.status: Accepted

Show users whose EULA status is not Accepted.

oror

Use a boolean query to express your query using OR logic.

Example

user.status: Active or user.status: Inactive

Show findings with one of these user status.