Import Asset Search Tokens

On the Import Asset tab of the Industrial Control System (ICS) application, use the following tokens to search the files and assets in your ICS inventory. Build your search queries by using various combinations of these tokens. Click each token for information about how to use it.

Supported Boolean operators

The Qualys Query Language (QQL) supports the following logical or Boolean query operators. Use these operators in your queries to narrow down or broaden your search.

and

Narrow down your search by using the 'and' operator in your Boolean query. The result contains all the token values that you provide in your query.

Example

Show the network traffic with the source or destination asset as an OT device and use UDP as the transport protocol

hardware.type: `OT Device` and interfaces.transport.protocol: UDP

not

Narrow down your search by using the 'not' operator in your Boolean query. The result contains all the other values except the one that you specify after 'not' in your query.

Example

Show the network traffic that does not have the source or destination asset as an OT device

not hardware.type: OT Device

Broaden your search by using the 'or' operator in your Boolean query. The result contains any of the token values that you provide in your query.

Examples

Show the network traffic with the source or destination asset as router or OT Device

hardware.type: `router` or hardware.type: `OT Device`

Show the network traffic with the source asset as router or destination asset as OT Device

source.hardware.type: `router` or destination.hardware.type: `OT Device`

Search tokens

file.name

Use a text value ##### to search the file name. For exact search, enclose the token value in backticks `<value>`.

Examples

Show any findings related to the file name

file.name: Plant_1_Assembly

Show any findings that contain parts of the file name

file.name: "Plant_1"

Show any findings that match the exact file name

file.name: 'Plant_1_Assembly'

file.extension

Use a text value ##### to search the file with the specific extension. For exact search, enclose the token value in backticks `<value>`.

Example

Show any findings that match the exact file extension

file.extension: '.L5X'

file.status

Search the files by their status. Choose the value from the options (Uploading, Imported, Importing, Analysing, Deleting, Deleted, or Failed).

Example

Show the files with status as Uploading

file.status: Uploading

file.vendor

Use a text value ##### to search the files by their vendors.

Example

Show the files from the vendor Siemens

file.vendor: Siemens

file.hash

Search the file using the hash value. For exact search, enclose the token value in backticks `<value>`.

Example

Show the file using this hash value

file.hash: `94ebb29b451a229e49c8f6e88afc2a15`

file.plantLocation

Use a text value ##### to search the files by plant location. For exact search, enclose the token value in backticks `<value>`.

Examples

Show the files related to the plant location

file.plantLocation: Stuttgart

Show the files that contain parts of the plant location

file.plantLocation: "Stuttgart"

Show the files that match the exact plant location

file.plantLocation: 'Stuttgart'

file.lastUpdated

Use a date range or specific date to search when the files were last updated.

Supported date formats: yyyy-MM-dd, yyyy-MM, yyyy

Examples

Show the files last updated on a specified date

file.lastUpdated: '2021-01-08'

Show the files last updated within the past 90 days (excluding day 90)

file.lastUpdated > now-90d

Show the files last updated by the user within the past 90 days (including day 90)

file.lastUpdated >= now-90d

Show the files last updated before past 90 days (excluding day 90)

file.lastUpdated < now-90d

Show the files last updated before the past 90 days (including day 90)

file.lastUpdated <= now-90d

Show the files last updated within the specified date range

file.lastUpdated : [2020-01-01 ... 2020-01-10]

Show the files last updated from two weeks ago till a second ago

file.lastUpdated : [now-2w ... now-1s]

file.lastUpdatedUser

Search the file that was last updated by the user.

Example

Show the last updated file by the admin

file.lastUpdatedUser: admin

file.assetCount

Use an integer to search the files that have the assets count from an imported file.

Example

Show all the files having 50 or less assets

file.assetCount <= 50

Import Asset Tokens

Supported Boolean operators

Search tokens