To search for dates you'll use a date range [start date .. end date] or a specific date.
Date variables help you define a date or date range you're interested in. We support yyyy, yyyy-MM, yyyy-MM-dd and more.
Show the vulnerabilities that were found for the first time January 1st 2020 and December 31st 2020 (i.e. yyyy)
vulnerabilities.firstFound: "2020"
Show the vulnerabilities that were found for the first time between June 1st and 30th 2022 (i.e. yyyy-MM)
vulnerabilities.firstFound: "2022-06"
Show the vulnerabilities that were found for the first time on the specified date (i.e. yyyy-MM-dd)
vulnerabilities.firstFound: '2020-01-13'
Show the vulnerabilities that were found for the first time on November 1st 2020 from 10 to 11am (i.e. yyyy-MM-dd HH)
vulnerabilities.firstFound: "2020-11-01 10"
Show the vulnerabilities that were found for the first time on November 1st 2020 at 10:15am (i.e. yyyy-MM-dd HH:mm)
Note: The time must be entered in Coordinated Universal Time (UTC).
vulnerabilities.firstFound: "2020-11-01 10:15"
Show the vulnerabilities that were found for the first time on November 1st 2020 at 10:15:44am (i.e. yyyy-MM-dd HH:mm:ss)
vulnerabilities.firstFound: "2020-11-01 10:15:44"
Type now- then a number and a time unit: y (year), M (month), w (week), d (day), h (hour), m (minute), s (second)
now-1y for 1 year ago
now-2M for 2 months ago
now-5d for 5 days ago
We support comparison operators in your date searches.
asset.created > now-90d
asset.created >= now-90d
asset.created < now-90d
asset.created: [2020-01-01 ..
2020-01-10]
Show the assets created within past 90 days (excluding day 90)
asset.created > now-90d
Show the assets created within past 90 days (including day 90)
asset.created >= now-90d
Show the assets created before past 90 days (excluding day 90).
asset.created < now-90d
Show the assets created before past 90 days (including day 90)
asset.created <= now-90d
Show the assets created within the specified date range
asset.created: [2020-01-01 .. 2020-01-11]
Show the assets created from two weeks ago till a second ago
asset.created: [now-2w .. now-1s]
Note: In this case, don't use the NOT operator in your range search to form a query NOT asset.created: [now-2w .. now-1s].
See Avoid usage of NOT.