Assets Search Tokens in VMDR OT

On the Assets tab of the VMDR OT application, use the following tokens to search the assets in your inventory. Build your search queries by using various combinations of these tokens. Click each token for information about how to use it.

Supported Boolean operators

The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.

andand

Narrow down your search by using the 'and' operator in your Boolean query. The result contains all the token values that you provide in your query.

Example

Show Siemens devices of the hardware type I/O Module

hardware.vendor: `Siemens` and hardware.type: "I/O Module"

notnot

Narrow down your search by using the 'not' operator in your Boolean query. The result contains all the other values except the one that you specify after 'not' in your query.

Examples

Show the assets based on the hardware vendor but exclude the assets from Siemens

not hardware.vendor: `Siemens`

Show the assets that run Windows Server 2008 SP1 but exclude assets that have the PLC hardware type

not hardware.type: `PLC` and operatingSystem: `Windows Server 2008 SP1`

oror

Broaden your search by using the 'or' operator in your Boolean query. The result contains any of the token values that you provide in your query.

Example

Show the assets from either of the hardware vendors

hardware.vendor: `Siemens` or hardware.vendor: `Rockwell`

Search tokens

asset.assetIDasset.assetID

Search an asset by its Qualys asset ID (UUID), assigned by an agent, or by a scanner appliance in case of Agentless Tracking. For exact search, enclose the token value in backticks `<value>`.

Example

Show the asset having UUID 56863af6-301e-3788-aa95-95b5f844ad2a

asset.assetID: '56863af6-301e-3788-aa95-95b5f844ad2a'

 

asset.createdasset.created

Use a date range or specific date to search the assets based on the date created. For exact search, enclose the token value in backticks `<value>`.

Supported date formats: yyyy-MM-dd, yyyy-MM, yyyy

Examples

Show the assets created on the specified date

asset.created: '2020-01-08'

Show the assets created within past 90 days (excluding day 90)

asset.created > now-90d

Show the assets created within past 90 days (including day 90)

asset.created >= now-90d

Show the assets created before past 90 days (excluding day 90)

asset.created < now-90d

Show the assets created before past 90 days (including day 90)

asset.created <= now-90d

Show the assets created within the specified date range

asset.created: [2020-01-01 .. 2020-01-10]

Show the assets created from two weeks ago till a second ago

asset.created: [now-2w .. now-1s]

Note: An asset is created in the inventory when it is discovered and scanned for the first time by a scanner appliance or when Qualys agent is installed on the asset.

 

asset.discovery.protocolasset.discovery.protocol

Search the assets that are inventoried via specific ICS Protocols. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets inventoried using the ENIP protocol

asset.discovery.protocol: `ENIP`

 

asset.lastModifiedasset.lastModified

Use a date range or specific date to search for assets that were last modified by the user.

Supported date formats: yyyy-MM-dd, yyyy-MM, yyyy

Examples

Show the assets last modified by the user on a specified date

asset.lastModified: '2022-01-01'

Show the assets last modified by the user within the past 90 days (excluding day 90)

asset.lastModified > now-90d

Show the assets last modified by the user within past 90 days (including day 90)

asset.lastModified >= now-90d

Show the lassets ast modified by the user before past 90 days (excluding day 90)

asset.lastModified < now-90d

Show the assets last modified by the user before past 90 days (including day 90)

asset.lastModified <= now-90d

Show the assets last modified by the user within the specified date range

asset.lastModified: [2021-01-01 .. 2022-01-01]

Show the assets last modified by the user from two weeks ago till a second ago

asset.lastModified: [now-2w .. now-1s]

 

asset.lastUpdatedasset.lastUpdated

Use a date range or specific date to search when the assets were last updated in the inventory. The update date changes whenever the asset is rescanned or an agent uploads the host data to the cloud platform.

Supported date formats: yyyy-MM-dd, yyyy-MM, yyyy

Examples

Show assets last updated on a specified date

asset.lastUpdated: '2020-01-08'

Show the assets last updated within past 90 days (excluding day 90)

asset.lastUpdated > now-90d

Show the assets last updated within past 90 days (including day 90)

asset.lastUpdated >= now-90d

Show the assets last updated before past 90 days (excluding day 90)

asset.lastUpdated < now-90d

Show the assets last updated before past 90 days (including day 90)

asset.lastUpdated <= now-90d

Show the assets last updated within the specified date range

asset.lastUpdated : [2020-01-01 .. 2020-01-10]

Show the assets last updated from two weeks ago till a second ago

asset.lastUpdated : [now-2w .. now-1s]

 

asset.modifiedasset.modified

Search the assets that are modified by the user. Select true or false as the token value.

Example

Show the assets that are modified by the user

asset.modified: true

 

asset.nameasset.name

Use a text value ##### to search the assets by their name. For exact search, enclose the token value in backticks `<value>`.

Examples

Show any findings related to the asset name

asset.name: Car Assembly

Show any findings that contain parts of the asset name

asset.name: “Car Assembly”

Show any findings that match the exact name ACMENVT7

asset.name: `ACMENVT7`

 

asset.orderidasset.orderid

Use text value ##### to search the assets by their order ID. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets that have order ID 6ES7412-3HJ14-0AB0  

asset.orderid: '6ES7412-3HJ14-0AB0'

Note: All Siemens devices have an Order number attached to them. This is also known as Article Number or Market Facing Number. Each character or number in the string represents the device's characteristics or attributes.It is a 16-digit alpha-numeric string represents the device's characteristics or attributes

 

asset.riskasset.risk

Use an integer as the token value to search assets by their risk scores.

Examples

Show the assets with a risk score of 9

asset.risk: 9

Show the assets for which risk score is not yet calculated

asset.risk is null

Show the assets with a valid risk score

not asset.risk is null

Note: Assets with a risk score between 0 to 10 are displayed.

 

asset.serialnumberasset.serialnumber

Search the assets by their serial numbers. For exact search, enclose the token value in backticks `<value>`.

Example

Show the asset that has the serial number 0x00991222 .

asset.serialnumber: '0x00991222'

 

asset.stateasset.state

Use text value ##### to search assets based on their state.

Example

Show the assets with the state RUN_P

asset.state: RUN_P

 

asset.vulnerabilities.countasset.vulnerabilities.count

Use an integer to search the assets by the number of total vulnerabilities detected.

Example

Show the assets having 6 or less vulnerabilities

asset.vulnerabilities.count <= 6

 

firmwareversionfirmwareversion

Search assets by their firmware version. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets having firmware version 30.1  

firmwareversion: `30.1`

 

hardware.category1hardware.category1

Search the assets based on their hardware category 1 value. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets with high-level category as Field Instruments

hardware.category1: Field Instruments

 

hardware.category2hardware.category2

Search the assets by their hardware category 2 value. For exact search, enclose the token value in backticks `<value>`.

Example

If you are searching for assets that are laser printers, then category1 is Printers and category2 is Laser.

Show any findings that match exact value

hardware.category2: Laser

 

hardware.classhardware.class

Search the assets based on their hardware class value. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets with hardware class as OT

hardware.class: OT

hardware.manufacturerhardware.manufacturer

Search the assets by their hardware manufacturer. For exact search, enclose the token value in backticks '<value>`.

Examples

Show the assets related to hardware manufacturer Schneider Electric

hardware.manufacturer: Schneider Electric

Show the assets that contain Schneider or Electric, or both in their hardware manufacturer name

hardware.manufacturer: "Schneider Electric"

Show the assets that have Siemens as their hardware manufacturer name

hardware.manufacturer: `Siemens`

 

hardware.mappedhardware.mapped

Search the assets for which the hardware information is catalogued or uncatalogued. Select Cataloged or Uncataloged as the token value.

Example

Show the assets for which the hardware information is cataloged

hardware.mapped: Cataloged

 

hardware.modelhardware.model

Use a text value ##### to search the assets based on their hardware model. For exact search, enclose the token value in backticks `<value>`.

Examples

Show assets related to the hardware model name

hardware.model: SIMATIC S7-300

Show the assets that have Dell or Latitude, or both in their hardware model name

hardware.model: "Dell Latitude"

Show assets that haveDell Latitude as their hardware model name

hardware.model: `Dell Latitude`

 

hardware.versionhardware.version

Use an integer as the token value to search assets by their hardware version. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets having hardware version 5

hardware.version: `5`

 

interfaces.addressinterfaces.address

Use text value ##### to search an asset by its IP address.

Example

Show the asset which has the specified IP address

interfaces:(address: 192.168.1.10)

 

interfaces.macAddressinterfaces.macAddress

Use text value ##### to search an asset by its MAC address. For exact search, enclose the MAC address in backticks `<value>`.

Example

Show the asset which has the specified MAC address

interfaces:(macAddress: `5C-88-16-A9-73-5A`)

 

inventory.fileHashinventory.fileHash

Search the assets created from the source Industrial OCA using the hash of a file. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets from Industrial OCA using this hash value

inventory.fileHash: `c9d0c6e534b51a733ff64e1fd3c4141`

 

inventory.fileNameinventory.fileName

Search the assets created from the source Industrial OCA using the name of a file. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets that belong to the file with the name Germany_Plant_1

inventory.fileName: `Germany_Plant_1`

 

interfaces.protocolinterfaces.protocol

Search the assets by their interface protocol. Specify the protocol name as the token value. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets that have identified MODBUS TCP protocol on their interfaces

interfaces.protocol: `MODBUS TCP`

 

inventory.sourceinventory.source

Search the assets created from the source. Select the value from the option Passive Sensor or Industrial OCA. For exact search, enclose the token value in backticks `<value>`.

Example

Show the assets from Passive Sensor

inventory.source: `Passive Sensor`

Show the assets from Industrial OCA

inventory.source: `Industrial OCA`

 

operatingSystemoperatingSystem

Search the assets by their operating system. For exact search, enclose the token value in backticks '<value>`.

Examples

Show the assets related to Windows Server 2008 SP1

operatingSystem: Windows 2008 SP1

Show the assets that run any version of Windows Server 2008 (for example, Standard, Enterprise Edition, Datacenter) with any service pack

operatingSystem: "Windows 2008"

Show the assets that run Windows Server 2008 SP1

operatingSystem: `Windows Server 2008 SP1`

 

operatingSystem.category1operatingSystem.category1

Use text value ##### to search the assets by operating system category 1 value.

Example

If you are searching for assets with Windows Embedded operating system, then category1 is Windows and category2 is Embedded.

Show any findings that match the exact value

operatingSystem.category1: Windows

 

passiveSensor.idpassiveSensor.id

Use a string value ##### to search assets sensed by a certain sensor ID. 

Example

Show the assets discovered by the sensor with the specific ID

passiveSensor.id: "032589611212:1638792150:574815:701:1638792150:574815:701"

 

passiveSensor.locationpassiveSensor.location

Use a text value ##### to search assets based on specific sensor location. For exact search, enclose the token value in backticks `<value>`. 

Example

Show assets with sensor location (appliance location label) as SanJose1

passiveSensor.location: "SanJose1"

 

passiveSensor.namepassiveSensor.name

Use a text value ##### to find assets based on specific sensor name. For exact search, enclose the token value in backticks `<value>`.

Example

Show assets with sensor name as ICS-PS-P27-IN03-218-238

passiveSensor.name: `ICS-PS-P27-IN03-218-238`

 

purdue.levelpurdue.level

Search the assets that belong to a Purdue level.

Examples

Show the assets that belong to Purdue Level 0

purdue.level: `Level 0`

Show the assets for which Purdue level is not defined or mapped

purdue.level is null

Show the assets that are mapped with a valid Purdue level

not purdue.level is null

Note: Assets belonging to the Purdue level between Level 0 and Level 5 are displayed.

 

tags.businessImpacttags.businessImpact

Find assets with certain business impact (HIGH, MINOR, LOW, MEDIUM, CRITICAL). Select from tag values in the drop-down menu.

Example

Find assets with high business impact

tags.businessImpact : HIGH

 

tags.idtags.id

Use a text value ##### to find the assets with tag ID.

Example

Show the assets with the tag ID

tags.id: `79eb654f-6eca-4922-9adf-0d39bd7cf3f2`

 

tags.nametags.name

Use a text value ##### to search the asset by its tag name. For exact search, enclose the token value in backticks `<value>`.

Examples

Show any findings related to the tag name

tags.name: network blue

Show any findings that contain parts of the tag name

tags.name: “network blue”

Show any findings that match the exact name network blue

tags.name: `network blue`

 

 

For information about search tokens on the Vulnerabilities tab, see Vulnerabilities Search Tokens.

For information about search tokens on the Network tab, see Network Search Tokens.

For information about search tokens on the Import Asset tab, see Import Asset Search Tokens.