Search Tokens for Scans
Click to view navigation pane

Home

Search Tokens for Scans

You can use the search tokens available in the Scan List tab and refine your search results. Click each token to learn more about it.

Generic | Scan List

Generic

andand

Use a boolean query to express your query using AND logic.

Example

Find web applications with certain scan status and tag

webapp.lastScanStatus:"SUBMITTED" AND webapp.tags.name: "MS WAS 1000 Webapp"

notnot

Use a boolean query to express your query using NOT logic.

Example

Show web applications that don't have last scan status as CANCELED

NOT webapp.lastScanStatus:"CANCELED"

oror

Use a boolean query to express your query using OR logic.

Example

Show findings with one of these id values

vulnerability.id:3758394 OR vulnerability.id:3495166

Scan List Tokens

Use these search tokens to find scan list.

scan.authenticationRecord.namescan.authenticationRecord.name

Use values within quotes or backticks to find scans with given authentication record name.

Examples

Find scans with the authentication record that contains part of the given name

scan.authenticationRecord.name: "Test"

Find scans with the given authentication record name

scan.authenticationRecord.name: `Test`

scan.authStatusscan.authStatus

Select the authentication status to find scans with specified authentication status: FAILURE, NOT_USED, NO_AUTH, PARTIAL, SUCCESS

Example 

Find scans with specified authentication status type

scan.authStatus:NOT_USED

scan.cancelledBy.firstNamescan.cancelledBy.firstName

Use values within quotes or backticks to find scans canceled by specified user’s first name.

Example

Find scans that are canceled by the user whose first name is Chandler

scan.cancelledBy.firstName: Chandler

scan.cancelledBy.lastNamescan.cancelledBy.lastName

Use values within quotes or backticks to find scans canceled by specified user’s last name.

Example

Find scans that are canceled by the user whose last name is Bing

scan.cancelledBy.lastName: Bing

scan.cancelledBy.usernamescan.cancelledBy.username

Use values within quotes or backticks to find scans canceled by specified user name.

Example

Find scans that are canceled by the user whose username is quays_pp

scan.cancelledBy.username: quays_pp

scan.cancelModescan.cancelMode

Select the cancel mode to find scans with the specified cancel mode: USER, SYSTEM.

Example

Find scans canceled by the user, that is, cancel mode as USER

scan.cancelMode:USER

scan.categoryscan.category

Select a scan category to find scans with the specified category: MULTI, SINGLE, SLICE

Example

Find the scans with scan category as MULTI 

scan.category: "MULTI"

scan.dnsOverride.namescan.dnsOverride.name

Use values within quotes or backticks to find scans with the specified DNS override record name.

Examples

Find scans that contain part of the given DNS override record name  

scan.dnsOverride.name:"Test"

Find scans with the given DNS override record name

scan.dnsOverride.name:`Test`

scan.endDatescan.endDate

Use a date range or specific date to find scans that ended in the given date range.

Examples

Find scans that ended in past 6 months

scan.endDate:[now-6M .. now]

Find scans that ended on specified date

scan.endDate: "2020-03-20"

Find scans that ended after a specified date

scan.endDate >"2020-03-20"

Find scans that ended between March 2020 to Dec 2020

scan.endDate:[2020-03-01 .. 2020-12-31]

scan.scanTrustEnabledscan.scanTrustEnabled

Use the values true | false to find scans for which scan trust is enabled or disabled. 

Examples

Find scans for which the scan trust option is enabled

scan.scanTrustEnabled: true

Find scans for which the scan trust option is disabled

scan.scanTrustEnabled: false

scan.excludedQidsscan.excludedQids

Use an integer value to find scans with the given QID excluded from the scan.

Example

Find scans with given QID excluded 

scan.excludedQids:150124

scan.idscan.id

Use an integer value to find scans with the specified ID.

Example

Find the scan with the given ID

scan.id: 9725

scan.igCountscan.igCount

Use an integer value to find the scan with the given Information Gathered detections count.

Example

Find scans that have Information Gathered detections count as 10

scan.igCount:10

scan.inScopeQidsscan.inScopeQids

Use an integer value to find scans with given QIDs in the scan scope.

Example

Find scans with given QIDs in scan scope

scan.inScopeQids:150124

scan.launchedBy.firstNamescan.launchedBy.firstName

Use values within quotes or backticks to find scans launched by the specified user’s first name.

Example

Find scans that are launched by the user whose first name is Chandler

scan.launchedBy.firstName: Chandler

scan.launchedBy.lastNamescan.launchedBy.lastName

Use values within quotes or backticks to find scans launched by the specified user’s last name.

Example

Find scans that are launched by the user whose last name is Bing

scan.launchedBy.lastName: Bing

scan.launchedBy.usernamescan.launchedBy.username

Use values within quotes or backticks to find scans launched by the specified user’s user name.

Example

Select scans which updated by the user whose username is quays_pp

scan.launchedBy.username: quays_pp

scan.linksCrawledscan.linksCrawled

Use an integer value to find scans with the given count of crawled links.

Example

Find scan with given links crawled count

scan.linksCrawled:100

scan.level1VulnCountscan.level1VulnCount

Use an integer value to find scans with the given level 1 vulnerability count.

Example

Find scans with given level 1 vulnerability count

scan.level1VulnCount:100

scan.level2VulnCountscan.level2VulnCount

Use an integer value to find scans with the given level 2 vulnerability count.

Example

Find scans with given level 2 vulnerability count

scan.level2VulnCount:100

scan.level3VulnCountscan.level3VulnCount

Use an integer value to find scans with the given level 3 vulnerability count.

Example

Find scans with given level 3 vulnerability count

scan.level3VulnCount:100

scan.level4VulnCountscan.level4VulnCount

Use an integer value to find scans with the given level 4 vulnerability count.

Example

Find scans with given level 4 vulnerability count

scan.level4VulnCount:100

scan.level5VulnCountscan.level5VulnCount

Use an integer value to find scans with the given level 5 vulnerability count.

Example

Find scans with given level 5 vulnerability count

scan.level5VulnCount:100

scan.modescan.mode

Select the scan mode to find scans in the selected mode: On-Demand API, On-Demand UI, and Scheduled.

Example

Find scans with specified scan mode

scan.mode:On-Demand API

scan.namescan.name

Use values within quotes or backticks to find scans with the specified scan name.

Examples

Find scans that contain a part of the given name

scan.name:"TestScan"

Find scans with the given name

scan.name:`TestScan`

scan.optionProfile.namescan.optionProfile.name

Use values within quotes or backticks to find scans with the given option profile name.

Examples

Find scans that contain part of the given option profile name

scan.optionProfile.name:"TestScan"

Find scans with the given option profile name

scan.optionProfile.name:`TestScan`

scan.parent.namescan.parent.name

Use values within quotes or backticks to find the slice (child) scans with the given parent scan name.

Examples

Find slice (child) scans that contain part of the given parent scan name

scan.parent.name:"TestScan"

Find slice (child) scans with the given parent scan name

scan.parent.name:`TestScan`

scan.progressiveScanningEnabledscan.progressiveScanningEnabled

Use the values true | false to find scans for which progressive scanning is enabled or disabled.

Examples

Find scans for which progressive scanning is enabled

scan.progressiveScanningEnabled:true

Find scans for which progressive scanning is disabled

scan.progressiveScanningEnabled:false

scan.proxy.namescan.proxy.name

Use values within quotes or backticks to find scans with the given proxy name.

Example

Find scans that contain part of the given proxy name

scan.proxy.name:"TestProxy"

Find scans with the given proxy name

scan.proxy.name:`TestProxy`

scan.scannerAppliance.namescan.scannerAppliance.name

Use values within quotes or backticks to find scans with the given scanner appliance name.

Examples

Find scans that contain a part of the given Scanner Appliance name

scan.scannerAppliance.name:"TestProxy"

Find scans with the given Scanner Appliance name

scan.scannerAppliance.name:`TestProxy`

scan.scannerApplianceTags.namescan.scannerApplianceTags.name

Use values within quotes or backticks to find scans with the given tag name added to the scanner appliance. 

Example

Find scans that contain part of the given tag name added to the scanner appliance 

scan.scannerApplianceTags.name:"TestProxy"

Find scans with the given tag name added to the scanner appliance

scan.scannerApplianceTags.name:`TestProxy`

scan.scannerTypescan.scannerType

Select the scanner type to find scans with the selected scanner type: EXTERNAL, INTERNAL, SCANNER_TAGS.

Example

Find scans the with specified scanner type

scan.scannerType:EXTERNAL

scan.referencescan.reference

Use a text value ##### to find scans with the given scan reference. 

Example

Find scans with given scan reference 

scan.reference:`abc`

scan.typescan.type

Select the type of scan to find scans with the selected scan type: AUTHENTICATION_TEST, DISCOVERY, VULNERABILITY.

Example

Find scans with the specified scan type

scan.type:DISCOVERY

scan.schedule.namescan.schedule.name

Use values within quotes or backticks to find scans with the given scan schedule name.

Examples

Find scans that contain a part of the given scan schedule name

scan.schedule.name:"TestSchedule"

Find scans with the given scan schedule name

scan.schedule.name:`TestSchedule`

scan.riskscan.risk

Use an integer value to find scans with the given scan risk.

Example

Find scans with given risk

scan.risk:4

scan.sensitiveContentCountscan.sensitiveContentCount

Use an integer value to find scans with the given sensitive content count.

Example

Find scans with the given sensitive content count

scan.sensitiveContentCount:40

scan.severityscan.severity

Select a severity value to find scans with selected scan severity: HIGH, LOW, MEDIUM, NONE.

Example

Find scans with the specified scan severity

scan.severity:MEDIUM

scan.startDatescan.startDate

Use a date range or specific date to find scans that were started on the given date or date range.

Examples

Find scans that started in past 6 months

scan.startDate:[now-6M .. now]

Find scans that started on specified date

scan.startDate:"2020-03-20"

Find scans that started after a specified date

scan.startDate>"2020-03-20"

Select scans started between March 2020 to Dec 2020

scan.startDate:[2020-03-01 .. 2020-12-31]

scan.statusscan.status

Select scan status to find scans with selected scan consolidated status: CANCELED, CANCELED WITH RESULTS, CANCELING, ERROR, FINISHED, NO HOST ALIVE, NO WEB SERVICE, PROCESSING, RUNNING, SCAN NOT LAUNCHED, SCANNER NOT AVAILABLE, SERVICE ERRORS DETECTED, SUBMITTED, TIME LIMIT EXCEEDED, TIME LIMIT REACHED.

Example

Find scans with the specified scan consolidated status

scan.status:FINISHED

scan.target.tags.namescan.target.tags.name

Use values within quotes or backticks to find scans with specified tag name added to the scan target.

Examples

Find scans with a part of the specified tags added to the scan target

scan.target.tags.name:"test"

Find scans with specified tags added to the scan target

scan.target.tags.name:`test`

scan.target.urlscan.target.url

Use values within quotes or backticks to find scans with the given target web application url.

Examples

Find scans that contain part of the given target url

scan.target.url:"https://www.qualys.com"

Find scans that contain the given target url

scan.target.url:`https://www.qualys.com`

scan.target.asset.namescan.target.asset.name

Use values within quotes or backticks to find scans with the given target web application name.

Examples

Find scans that contain part of the given target web application name

scan.target.asset.name:"assetName"

Find scans that contain the given target web application name

scan.target.asset.name:`assetName`

scan.totalVulnCountscan.totalVulnCount

Use an integer value to find scans with the given total vulnerability count.

Example

Find scans with given total vulnerability count

scan.totalVulnCount:50

scan.updatedscan.updated

Use a date range or specific date to find scans updated on the given date or date range.

Example

Find scans that were updated  in past 6 months

scan.updated:[now-6M .. now]

Select scans that were updated on specified date

scan.updated:"2020-03-20"

Select scans that were updated after a specified date

scan.updated>"2020-03-20"

Select scans that were updated between March 2020 to Dec 2020

scan.updated:[2020-03-01 .. 2020-12-31]

scan.uuidscan.uuid

Use text value to find scans with given scan uuid.

Example

Find scans with given scan uuid

scan.uuid:`17eeec0b2-abf4-4d7b-877a-13146ddadccf`

scan.findings.criticalityscan.findings.criticality

Select a criticality value to find scans with the specified detection's criticality.

Example

Find scans with specified detection criticality

scan.findings:(criticality:HIGH )

scan.findings.cvss3Info.baseScorescan.findings.cvss3Info.baseScore

Use an integer value ##### to find scans with given scan detections with the specified CVSS3 base score value.

Examples

Find scans with detection's CVSS3 base score greater than 7

scan.findings:(cvss3Info.baseScore >7)

Find scans with detection's CVSS3 base score less than or equal to 7

scan.findings:(cvss3Info.baseScore <=7)

Find scans with detection's CVSS3 base score equal to 7

scan.findings:(cvss3Info.baseScore:7)

scan.findings.cvss3Info.temporalScorescan.findings.cvss3Info.temporalScore

Use an integer value ##### to find scans with the specified CVSS3 temporal score value.

Examples

Find scans with detection's CVSS3 temporal score greater than 7

scan.finding:(cvss3Info.temporalScore>7)

Find scans with detection's CVSS3 temporal score less than or equal to 7

scan.findings:(cvss3Info.temporalScore<= 7)

Find scans with detection's CVSS3 temporal score equal to 7

scan.findings:(cvss3Info.temporalScore:7)

scan.findings.cweIdsscan.findings.cweIds

Use values within quotes or backticks to find scans with a given CWE Id associated with it.

Example

Find scans with the given CWE ID associated to scan detections 

scan.findings:(cweIds:`CWE-56`)

scan.findings.groupNamescan.findings.groupName

Use values within quotes or backticks to find scans with the given scan detection's group name.

Example

Find scans that have given group name associated to scan detections

scan.findings:(groupName:`Cross-Site Scripting`)

scan.findings.groupTitlescan.findings.groupTitle

Use values within quotes or backticks to find scans with the given scan detection's group title.

Example

Find scans that have given group title associated to scan detections

scan.findings:(groupTitle:`XSS`)

scan.findings.titlescan.findings.title

Use values within quotes or backticks to find scans with the given scan detection's title.

Example

Find scans with the given scan detection's title 

scan.findings:(title:`Test Detection`)

scan.findings.owaspTopTen.idscan.findings.owaspTopTen.id

Use an integer to find scans with the given scan detection's OWASP top ten category ID.

Example

Find scan where scan detection's owaspTopTen2021 category ID is 7

scan.findings:(owaspTopTen.id:7)

The following list provides the ID and corresponding vulnerability name.

1: Broken Access Control
2: Cryptographic Failures
3: Injection
4: Insecure Design
5: Security Misconfiguration
6: Vulnerable and Outdated Components
7: Identification and Authentication Failures
8: Software and Data Integrity Failures
9: Security Logging and Monitoring Failures
10: Server Side Request Forgery (SSRF)

scan.findings.owaspTopTen.namescan.findings.owaspTopTen.name

Use a text value to find scans with given scan detection's owasp top ten category name.

Example

Find scans where scan detection's owaspTopTen2021 category name is "Identification and Authentication Failures"

scan.findings:(owaspTopTen.name:`Identification and Authentication Failures`)

scan.findings.paramscan.findings.param

Use a text value to find scans with the given parameter used for confirming scan's detection.

Example

Find scans where the parameter 'comment.comment from url' is used for confirming detection

scan.findings:(param:`comment.comment from url`)

scan.findings.paramTypescan.findings.paramType

Use a text value to find scans with the given parameter type used for confirming scan's detection.

Example

Select scans where parameter type 'cookie' is used for confirming detection

scan.findings:(paramType:`Cookie`)

scan.findings.qidscan.findings.qid

Use an integer to find scans with the scan's detection reported with the given qid.

Examples

Find scans with scan detection reported with the given qid

scan.findings:(qid: 150001)

Find scans with either of the scan detections qid from list

scan.findings:(qid:[150001, 150100, 150009])

scan.findings.severityscan.findings.severity

Use an integer value to find scans with the given scan detection's current severity level.

Examples

Find scans with scan detection's severity greater than 3

scan.findings:(severity>3)

Find scans with scan detection's severity less than or equal to 3

scan.findings:(severity<=3)

Select scans with scan detection's severity 3

scan.findings:(severity:3)

scan.findings.originalSeverityscan.findings.originalSeverity

Use an integer value to find scans with scan detection's original severity level.

Examples

Select scans with scan detection's original severity greater than 3

scan.findings:(originalSeverity>3)

Select scans with scan detection's original  severity less than or equal to 3

scan.findings:(originalSeverity<=3)

Select scans with scan detection's original  severity 3

scan.findings:(originalSeverity:3)

scan.findings.typeDetectedscan.findings.typeDetected

Select the detection type to find scans with the given scan detection's type: CONFIRMED VULNERABILITY, INFORMATION_GATHERED, POTENTIAL_VULNERABILITY, and SENSITIVE_CONTENT. 

Examples

Find scans where detections of the scan are of CONFIRMED_VULNERABILITY type

scan.findings:(typeDetected:CONFIRMED_VULNERABILITY)

Find scans where detections of the scan are of either POTENTIAL_VULNERABILITY or SENSITIVE_CONTENT type

scan.findings:(typeDetected:[POTENTIAL_VULNERABILITY, SENSITIVE_CONTENT])

scan.findings.urlscan.findings.url

Use values within quotes or backticks to find scans with THE given URL associated with the scan detection.

Examples

Find scans with a part of the given URL associated with the scan detections

scan.findings:(url:"https://www.qualys.com")

Find scans with the given URL associated with the scan detections

scan.findings:(url:`https://www.qualys.com`)

scan.findings.uuidscan.findings.uuid

Use a text value to find scans with given uuid associated with the scan detections.

Example

Find scans with given scan's detection uuid 

scan.findings:(uuid:`17eeec0b2-abf4-4d7b-877a-13146ddadccf`)

scan.findings.idscan.findings.id

Use an integer value to find scans with the given scan's detection id. 

Example

Find scans with given scan's detection id

scan.findings:(id:`123`)

scan.findings.vulnerability.idscan.findings.vulnerability.id

Use an integer value to find scans with given local reference of the finding as provided in the scan result.

Example

Find scans with given local reference of the finding as provided in the scan result

scan.findings:(vulnerability.id:123)