Searching Users
Syntax help displayed in UI for User tokens. A complete list of tokens for writing search queries is provided below. Click each token to learn more about it.
Use a text value ##### in quotes to find a certain user account name.
Example
Show findings with this user account
user.account:"adminuser"
Use a text value ##### in quotes to find a certain user name.
Example
Show findings with this user name
user.username:"adminuser"
Use values within quotes or backticks to help you find users with certain email address.
Examples
Show any users with this email address
user.email: info@yourdomain.com
Show any users that contain components of email address
user.email: "info@yourdomain.com"
Show any users that match exact value
user.email: `info@yourdomain.com`
Use values within quotes or backticks to help you find users with their full name.
Examples
Show any users with this full name
user.fullName: Support Admin
Show any users that contain components of full name
user.fullName: "Support Admin"
Show any users that match exact value
user.fullName: `Support Admin`
Use a text value ##### in quotes to find users with a certain status (Active, Inactive).
Example
Show active users
user.status:"Active"
Use a text value ##### in quotes to find users of a certain type.
Example
Show SEM users
user.type:"SEM"
Use values within quotes or backticks to help you find the users with certain tag.
Examples
Show any users with this tag
user.tag: Field Force
Show any users that contain components of tag name
user.tag: "Field Force"
Show any user tags that match exact value
user.tag: `Field Force`
Use a text value ##### in quotes to find users associated with certain EULA.
Example
Show users associated to this EULA
user.eula.name:"System EULA"
user.eula.statususer.eula.status
Use a text value ##### in quotes to find users with certain EULA status (Pending, Accepted, Declined).
Example
Show users with pending EULA
user.eula.status:"Pending"
Use a date range or specific date to define when users were created.
Examples
Show users created within certain dates
user.created: [2018-01-01 ... 2018-01-10]
Show users created starting 2017-06-01, ending 3 months ago
user.created: [2017-06-01 ... now-3M]
Show users created starting 2 weeks ago, ending 1 second ago
user.created: [now-2w ... now-1s]
Show users created on a specific date
user.created:'2018-01-22'
Supported Boolean Operators
The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.
Use a boolean query to express your query using AND logic.
Example
user.status: Active and user.username: "adminuser"
Find user with this username and user status.
Use a boolean query to express your query using NOT logic.
Example
not user.eula.status: Accepted
Show users whose EULA status is not Accepted.
Use a boolean query to express your query using OR logic.
Example
user.status: Active or user.status: Inactive
Show findings with one of these user status.