Home

Searching for Microsoft Azure Resources

Use the search tokens below to search for resources discovered. You'll need to first choose cloud provider on the Resources tab to see the relevant tokens for your environment.  Looking for help with writing your query? click here

General

account.id

Use a text value ##### to show resources based on the unique account ID associated with the connector/ARN at the time of creation.

Example

Show findings with this account ID

account.id: 205767712438

account.alias

Use a text value ##### to show connectors based on the account alias associated with the connector/ARN at the time of creation.

Example

Show connectors with this account alias

account.alias: Example_connector

created

Use a date range or specific date to define when the resource was created.

Examples

Show resources created within certain dates

created: [2018-01-01 ... 2018-03-01]

Show resources created starting 2018-10-01, ending 1 month ago

created: [2018-01-01 ... now-1m]

Show resources created starting 2 weeks ago, ending 1 second ago

created: [now-2w ... now-1s]

Show resources created on specific date

created: 2018-01-08

updated

Use a date range or specific date to define when the resource was last updated.

Examples

Show resources updated within certain dates

updated: [2018-01-01 ... 2018-03-01]

Show resources updated starting 2018-10-01, ending 1 month ago

updated: [2018-01-01 ... now-1m]

Show resources updated starting 2 weeks ago, ending 1 second ago

updated: [now-2w ... now-1s]

Show resources updated on specific date

updated: 2018-01-08

name

Use quotes within values to help you find the resource name you're looking for.

Examples

Show any findings with this name

name: my-resource

Show any findings that contain parts of name

name: "my-resource"

provider

Select the name of the cloud service provider you're interested in. Select from names in the drop-down menu.

Example

Find resources synced from Amazon AWS

provider: aws

region

Select the name of the region you're interested in. Select from names in the drop-down menu.

Example

Find resources in the Singapore region

region: Singapore

resource.id

Use a text value ##### to find resources by the unique ID assigned to the resource.

Example

Show resources with ID acl-8e5198f5

resource.id: acl-8e5198f5

resource.type

Select the type of resource you're interested in. Select from names in the drop-down menu.

Example

Show resources of type Instance

resource.type: Instance

tag.key

Use a text value ##### to define the key of an AWS or Azure tag assigned to the resource (case sensitive).

Example

Show findings with key Department

tag.key: Department

tag.value

Use a text value ##### to define the value of an AWS or Azure tag assigned to the resource (case sensitive).

Example

Show findings with tag value Finance

tag.value: Finance

and

Use a boolean query to express your query using AND logic.

Example

Show findings with account ID 205767712438 and type Subnet

account.id: 205767712438 and resource.type: Subnet

not

Use a boolean query to express your query using NOT logic.

Example

Show findings that are not resource type Instance

not resource.type: Instance

or

Use a boolean query to express your query using OR logic.

Example

Show findings with one of these tag values

tag.value: Finance or tag.value: Accounting

projectId

Use a text value ##### to find GCP resources with a certain project Id.

Example

Show resources with this projectId

projectId: my-project-1513669048551

 

Azure: General

location

Select the name of the Azure location you're interested in. Select from names in the drop-down menu.

Example

Find resources in this location

location: Frankfurt

resourceGroupName

Use a text value ##### to find resources by the resource group name.

Example

Show resources with this group name

resourceGroupName: my-eastus-rg

subscriptionId

Use a text value ##### to find resources by the subscription ID.

Example

Show resources with this subscription ID

subscriptionId: fbb9ea64-abda-452e-adfa-83442409

Azure: SQL Server

These tokens are available in queries with resource.type:SQL Server

sqlserver.type

Use a text value ##### to find resources by the SQL Server type.

Example

Show resources with this type

sqlserver.type: Microsoft.sql

sqlserver.fullyQualifiedDomainName

Use a text value ##### to find resources by the SQL Server Fully Qualified Domain Name (FQDN).

Example

Show resources with this FQDN

sqlserver.fullyQualifiedDomainName: severname.database.windows.net

sqlserver.version

Use a text value ##### to find resources by the SQL Server version.

Example

Show resources with this version

sqlserver.version: 12

sqlserver.state

Use a text value ##### to find resources by the current SQL Server state.

Example

Show resources with this state

sqlserver.state: ready

Azure: SQL Server Database

These tokens are available in queries with resource.type:SQL Server Database

sqldatabase.edition

Select the database edition (basic, standard, premium) you're interested in. Select from names in the drop-down menu.

Example

Find resources with standard edition

sqldatabase.edition: standard

sqldatabase.status

Select the database status (online, offline, restoring, etc) you're interested in. Select from names in the drop-down menu.

Example

Show online databases

sqldatabase.status: online

Azure: Virtual Machine

These tokens are available in queries with resource.type:Virtual Machine

virtualmachine.vmId

Use a text value ##### to find resources by the virtual machine ID.

Example

Show resources with this virtual machine ID

virtualmachine.vmId: MyVMID

connector.remediationEnabled

Use  true to view the resources associated with the connector for which remediation is enabled.

Example

Show resources associated with the connector for which remediation is enabled

connector.remediationEnabled: TRUE

Note: This search token is available only if you enable Remediation feature (currently in preview mode). To enable Remediation feature for your subscription, contact your Technical Account Manager at Qualys.

action.status

Select the action status ("Sucess", "Queued", "Error") you're interested in. Select from names in the drop-down menu.

Example

Show resources with success status for remediation action

action.status: Success

Note: This search token is available only if you enable Remediation feature (currently in preview mode). To enable Remediation feature for your subscription, contact your Technical Account Manager at Qualys.

virtualmachine.vmSize

Use a text value ##### to find resources by size of the virtual machine.

Example

Show resources with this virtual machine size

virtualmachine.vmSize: Standard_DS1_v2

virtualmachine.networkSecurityGroup

Use a text value ##### to find the network security group of the virtual machine.

Example

Show resources with this network security group

virtualmachine.networkSecurityGroup: myNSG

virtualmachine.osType

Select the operating system (Linux, Windows) you're interested in. Select from names in the drop-down menu.

Example

Show resources with this operating system

virtualmachine.osType: Linux

virtualmachine.publicIpAddress

Use a text value ##### to find virtual machines with certain IP address.

Example

Show resources with this IP address

virtualmachine.publicIpAddress: 13.126.125.189

virtualmachine.status

Select the status (Creating, Deleting, Updating, etc.) of the virtual machine you're interested in. Select the required status from the drop-down menu.

Example

Show virtual machines with VM running status

virtualmachine.status: VM running

Azure: Virtual Network

These tokens are available in queries with resource.type:Virtual Network

virtualnetwork.type

Use a text value ##### to find resources by the virtual network type.

Example

Show resources with this virtual network type

virtualnetwork.type: Microsoft.Network/virtualNetworks

Azure: Web App

These tokens are available in queries with resource.type:Web App

webapp.kind

Use a text value ##### to find web apps based on the kind filter you are interested in..

Examples

Show any web apps with kind filter

webapp.kind: Linux

webapp.deploymentId

Use a text value ##### to find web apps based on the deployment ID of the web app.

Example

Show web apps with this deployment ID

webapp.deploymentId:depl-7495

webapp.state

Search web app based on its state.

Examples

Show web apps that are in running state

webapp.state:Running

webapp.availabilityState

>Select the web app state (NORMAL, LIMITED, DISASTER_RECOVERY_MODE) you're interested in. Select from names in the drop-down menu.

Example

Show web apps with availability state as LIMITED

webapp.availabilityState:LIMITED

webapp.usageState

Search the web apps based on their usage state (NORMAL, EXCEEDED). Select from names in the drop-down menu.

Example

Show web app on usage state

webapp.usageState:NORMAL

webapp.enabled

Use the values true | false to find whether web app is enabled or not.

Examples

Show web apps which are default container.

webapp.enabled:true

webapp.isDefaultContainer

Use the values true | false to find whether web app is the default container or not.

Examples

Show web apps which are default container.

webapp.isDefaultContainer:true

webapp.httpsonly

Use the values true | false to find whether HTTPSOnly feature is enabled or not on a web app.

Examples

Show web apps with HTTPSOnly feature enabled.

webapp.httpsonly:TRUE

webapp.redundancyMode

Use a text value ##### to define the redundancy mode of the web app.

Example

Show web apps with this redundancy mode.

webapp.redundancyMode:MANUAL

webapp.appserviceplan

Use a text value ##### to define the AppServicePlanId of webapp you're looking for.

Examples

Show web apps with this AppServicePlan ID.

webapp.appserviceplan:app-service-plan-123

webapp.defaultHostName

Use a text value ##### to define the default host name for web apps.

Example

Show web apps with this default host name

webapp.defaultHostName:windowsappabc123.azurewebsites.net

webapp.hostnames.enabled

Use a text value ##### to define the enabled host names of the web apps.

Example

Show web apps with this host names

webapp.hostnames.enabled:windowsappabc123.azurewebsites.net

webapp.hostnames.sslState

Select web apps based on the SSL  state of the enabled hosts (DISABLED, SNI_ENABLED, IP_BASED_ENABLED) you're interested in. Select from names in the drop-down menu.

Example

Show web apps with disabled SSL state

webapp.hostnames.sslState:DISABLED

webapp.clientAffinityEnabled

Use the values true | false to find whether client affinity is enabled or not on a web app.

Example

Show web apps with client affinity enabled

webapp.clientAffinityEnabled:TRUE

webapp.clientCertEnabled

Use the values true | false to find whether client cert is enabled or not on a web app.

Example

Show web apps with client cert enabled

webapp.clientCertEnabled:TRUE

Azure: Function App

These tokens are available in queries with resource.type:Function App

functionapp.kind

Use a text value ##### to find function apps based on the kind filter you are interested in..

Examples

Show any function apps with kind filter

functionapp.kind: Linux

functionapp.deploymentId

Use a text value ##### to find function apps based on the deployment ID of the function app.

Example

Show function apps with this deployment ID

functionapp.deploymentId:depl-7495

functionapp.state

Search function app based on its state.

Examples

Show function apps that are in running state

functionapp.state:Running

functionapp.availabilityState

>Select the function app state (NORMAL, LIMITED, DISASTER_RECOVERY_MODE) you're interested in. Select from names in the drop-down menu.

Example

Show function apps with availability state as LIMITED

functionapp.availabilityState:LIMITED

functionapp.usageState

Search the function apps based on their usage state (NORMAL, EXCEEDED). Select from names in the drop-down menu.

Example

Show function app on usage state

functionapp.usageState:NORMAL

functionapp.enabled

Use the values true | false to find whether function app is enabled or not.

Examples

Show function apps which are default container.

functionapp.enabled:true

functionapp.isDefaultContainer

Use the values true | false to find whether function app is the default container or not.

Examples

Show function apps which are default container.

functionapp.isDefaultContainer:true

functionapp.httpsonly

Use the values true | false to find whether HTTPSOnly feature is enabled or not on the function app.

Examples

Show function apps with HTTPSOnly feature enabled.

functionapp.httpsonly:TRUE

functionapp.redundancyMode

Use a text value ##### to define the redundancy mode of the function app.

Example

Show function apps with this redundancy mode.

functionapp.redundancyMode:MANUAL

functionapp.appserviceplan

Use a text value ##### to define the AppServicePlanId of function app you're looking for.

Examples

Show function apps with this AppServicePlan ID.

functionapp.appserviceplan:app-service-plan-123

functionapp.defaultHostName

Use a text value ##### to define the default host name for function apps.

Example

Show function apps with this default host name

functionapp.defaultHostName:windowsappabc123.azurewebsites.net

functionapp.hostnames.enabled

Use a text value ##### to define the enabled host names of the function apps.

Example

Show function apps with this host names

functionapp.hostnames.enabled:windowsappabc123.azurewebsites.net

functionapp.hostnames.sslState

Select function apps based on the SSL  state of the enabled hosts (DISABLED, SNI_ENABLED, IP_BASED_ENABLED) you're interested in. Select from names in the drop-down menu.

Example

Show function apps with disabled SSL state

functionapp.hostnames.sslState:DISABLED

functionapp.clientAffinityEnabled

Use the values true | false to find whether client affinity is enabled or not on a function app.

Example

Show function apps with client affinity enabled

functionapp.clientAffinityEnabled:TRUE

functionapp.clientCertEnabled

Use the values true | false to find whether client cert is enabled or not on a function app.

Example

Show function apps with client cert enabled

functionapp.clientCertEnabled:TRUE

functionapp.language

Use a text value ##### to find functionapps based on the language in which the functions under function apps are written.

Example

Show function apps with client cert enabled

functionapp.language:CSharp