Search Tokens for IT Assets

Syntax help displayed in UI for tokens. Click each token to learn more about it.

Note: Following tokens are not available for ITAM (Free) License Subscriber.
hardware.lifecycle.stage, hardware.lifecycle.eos, hardware.lifecycle.ga, hardware.lifecycle.intro, hardware.lifecycle.obs, software.license.category, software.license.subcategory, software.lifecycle.eol, software.lifecycle.eos, software.lifecycle.ga, software.lifecycle.stage, software.isPackage, software.isPackageComponent, operatingSystem.lifecycle.eol, operatingSystem.lifecycle.eos, operatingSystem.lifecycle.ga, operatingSystem.lifecycle.stage, asset.type

Asset Inventory and Passive Scanner | AWS EC2 | Microsoft Azure | Google Cloud Platform | Passive Scanner only

Asset Inventory and Passive Scanner

accounts.username

agent.activations.key

agent.activations.status

agent.agentID

agent.configurationProfile

agent.connectedFrom

asset.isContainerHost

agent.lastActivity

agent.lastCheckedIn

agent.lastInventory

agent.udcManifestAssigned

agent.version

asset.agentID

asset.assetID

asset.biosAssetTag

asset.biosDescription

asset.biosSerialNumber

asset.cpuCount

asset.created

asset.biosHardwareUUID

asset.hostID

asset.lastBoot

asset.lastLoggedOnUser

asset.lastUpdated

asset.mostFrequentUser

asset.name

asset.netbiosName

asset.timezone

asset.totalMemory

asset.trackingMethod

asset.type

asset.lastLocation

asset.lastLocation.continent

asset.lastLocation.country

asset.lastLocation.state

asset.lastLocation.city

asset.lastLocation.postal

connectors.connector.firstSeen

connectors.connector.lastSeen

connectors.connector.name

connectors.connector.type

container.product

container.version

container.noOfContainers

container.noOfImages

isDockerHost

docker.hasSensor

hardware

hardware.category

hardware.category1

hardware.category2

hardware.lifecycle.ga

hardware.lifecycle.intro

hardware.lifecycle.eos

hardware.lifecycle.obs

hardware.lifecycle.stage

hardware.manufacturer

hardware.model

hardware.product

interfaces.address

interfaces.dnsAddress

interfaces.gatewayAddress

interfaces.hostname

interfaces.interfaceName

interfaces.lastUpdated

interfaces.macAddress

interfaces.manufacturer

inventory.created

inventory.lastUpdated

inventory.sensorLocation

inventory.source

openPorts.description

openPorts.detectedService

openPorts.firstFound

openPorts.lastUpdated

openPorts.port

openPorts.protocol

operatingSystem

operatingSystem.architecture

operatingSystem.category

operatingSystem.category1

operatingSystem.category2

operatingSystem.edition

operatingSystem.installDate

operatingSystem.lifecycle.ga

operatingSystem.lifecycle.eol

operatingSystem.lifecycle.eos

operatingSystem.lifecycle.stage

operatingSystem.marketVersion

operatingSystem.name

operatingSystem.publisher

operatingSystem.update

operatingSystem.version

processors

processors.speed

provider

sensors.activatedForModules

agent.errorStatus

sensors.lastComplianceScan

sensors.lastFullScan

sensors.lastVmScan

sensors.pendingActivationForModules

sensors.sensor.firstSeen

sensors.sensor.lastSeen

sensors.sensor.name

sensors.sensor.type

services.description

services.name

services.status

software

software.architecture

software.category

software.category1

software.category2

software.edition

software.installDate

software.installPath

software.isPackage

software.isPackageComponent

software.lastUpdated

software.lastUseDate

software.license.category

software.license.subcategory

software.lifecycle.ga

software.lifecycle.eol

software.lifecycle.eos

software.lifecycle.stage

software.marketVersion

software.name

software.product

software.publisher

software.supportStage

software.type

software.update

software.version

software.component

tags.businessImpact

tags.name

volumes.free

volumes.name

volumes.size

AWS EC2

Use these tokens when searching your AWS EC2 assets on the Assets list.

- Your results may return Terminated instances. It's recommended you include aws.ec2instanceState in your query to reduce the number of results.

- The syntax is different when writing queries for tag rules than when searching assets in the Assets list. Be sure to follow the syntax tips in the drop-down when writing your query.

aws.ec2.accountId

aws.ec2.availabilityZone

aws.ec2.hasAgent

aws.ec2.hostname

aws.ec2.imageId

aws.ec2.instanceId

aws.ec2.instanceState

aws.ec2.instanceType

aws.ec2.isQualysScanner

aws.ec2.kernelId

aws.ec2.launchDate

aws.ec2.privateDNS

aws.ec2.privateIpAddress

aws.ec2.publicDNS

aws.ec2.publicIpAddress

aws.ec2.region.code

aws.ec2.region.name

aws.ec2.spotInstance

aws.ec2.subnetId

aws.ec2.vpcId

aws.tags

aws.tags.key

aws.tags.value

 

Microsoft Azure

Use these tokens when searching Microsoft Azure assets on the Assets list.

azure.tags

azure.tags.name

azure.tags.value

azure.vm.imageOffer

azure.vm.imagePublisher

azure.vm.imageVersion

azure.vm.location

azure.vm.macAddress

azure.vm.name

azure.vm.platform

azure.vm.privateIpAddress

azure.vm.publicIpAddress

azure.vm.resourceGroupName

azure.vm.size

azure.vm.state

azure.vm.subnet

azure.vm.subscriptionId

azure.vm.vmId

azure.vm.hasAgent

 

Google Cloud Platform

Use these tokens when searching Google Cloud Platform assets on the Assets list.

gcp.compute.hostname

gcp.compute.instanceId

gcp.compute.macAddress

gcp.compute.machineType

gcp.compute.network

gcp.compute.privateIpAddress

gcp.compute.projectId

gcp.compute.projectNumber

gcp.compute.publicIpAddress

gcp.compute.state

gcp.compute.zone

 

Supported Boolean Operators

The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.

and

not

or

 

Passive Scanner only

asset.fqdn

hardware.typingConfidence

inventory.sensorID

inventory.sensorName

openPorts.lastFound

openPort.lastUpdated

operatingSystem.typingConfidence

traffic.timestamp

traffic.total

traffic.ingress

traffic.egress

traffic.protocol

traffic.port

traffic.type

traffic.family

traffic.application

traffic.service

inventory.scannerID

inventory.scannerName

inventory.scannerLocation

client.type

client.assetID

client.name

client.lastLoggedOnUser

client.tags.name

client.hardware.category

client.hardware

client.operatingSystem.category

client.operatingSystem

client.interfaces.macAddress

client.interfaces.address

server.type

server.assetID

server.name

server.lastLoggedOnUser

server.tags.name

server.hardware.category

server.hardware

server.operatingSystem.category

server.operatingSystem

server.interfaces.macAddress

server.interfaces.address

traffic.serverPort

traffic.stc.volume

traffic.cts.volume

traffic.total.volume

traffic.reportingStartTime

traffic.reportingEndTime