Syntax help displayed in UI for User tokens. A complete list of tokens for writing search queries is provided below. Click each token to learn more about it.
Example
Show findings with this user account
user.account:"adminuser"
Example
Show findings with this user name
user.username:"adminuser"
Examples
Show any users with this email address
user.email: info@yourdomain.com
Show any users that contain components of email address
user.email: "info@yourdomain.com"
Show any users that match exact value
user.email: `info@yourdomain.com`
Examples
Show any users with this full name
user.fullName: Support Admin
Show any users that contain components of full name
user.fullName: "Support Admin"
Show any users that match exact value
user.fullName: `Support Admin`
Example
Show active users
user.status:"Active"
Example
Show SEM users
user.type:"SEM"
Examples
Show any users with this tag
user.tag: Field Force
Show any users that contain components of tag name
user.tag: "Field Force"
Show any user tags that match exact value
user.tag: `Field Force`
Example
Show users associated to this EULA
user.eula.name:"System EULA"
user.eula.statususer.eula.status
Example
Show users with pending EULA
user.eula.status:"Pending"
Examples
Show users created within certain dates
user.created: [2018-01-01 ... 2018-01-10]
Show users created starting 2017-06-01, ending 3 months ago
user.created: [2017-06-01 ... now-3M]
Show users created starting 2 weeks ago, ending 1 second ago
user.created: [now-2w ... now-1s]
Show users created on a specific date
user.created:'2018-01-22'
The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.
Use a boolean query to express your query using AND logic.
Example
user.status: Active and user.username: "adminuser"
Find user with this username and user status.
Use a boolean query to express your query using NOT logic.
Example
not user.eula.status: Accepted
Show users whose EULA status is not Accepted.
Use a boolean query to express your query using OR logic.
Example
user.status: Active or user.status: Inactive
Show findings with one of these user status.