Assets Query Filters

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value.

They are used in conjunction with the filter query parameter in the API request.

Armis Centrix filters for `query_devices`

Field	Operators	Supported Values
device.hw_info.bios_manufacturer	eq, ne, in, not_in	string
device.ip	eq, ne, in, not_in	string
device.location.desc	eq, ne, in, not_in	string
device.mac	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in, like, not_like	name
device.os.version	eq, ne, in, not_in	string
device.risk_score	gt, gte, lt, lte	integer
device.type	eq, ne, in, not_in	string
device.uid	eq, ne, in, not_in	string

CrowdStrike Falcon Spotlight filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

Nozomi Vantage filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gt, gte, lt, lte	integer
device.hw_info.serial_number	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, in, not_in	string
device.ip_addresses	eq, ne, in, not_in	string
device.last_seen_time	gt, gte, lt, lte	integer
device.mac	eq, ne, in, not_in	string
device.mac_addresses	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in, like, not_like	stringProcessMap("name")
device.network_interfaces.name	eq, ne, in, not_in	string
device.risk_level_id	eq, ne, in, not_in	0, 1, 2, 3, 4
device.risk_score	gt, gte, lt, lte	integer
device.type	eq, ne, in, not_in, like, not_like	string
device.type_id	eq, ne, in, not_in	2, 4, 5, 10, 89, 90, 96
device.uid	eq, ne, in, not_in, like, not_like	string
device.vendor.name	eq, ne, in, not_in, like, not_like	string
time	gt, gte, lt, lte	integer

Qualys VMDR filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

ServiceNow CMDB filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gt, gte, lt, lte	integer
device.hostname	eq, ne, in, not_in, like, not_like	string
device.hw_info.serial_number	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, in, not_in, like, not_like	string
device.last_seen_time	gt, gte, lt, lte	integer
device.mac	eq, ne, in, not_in, like, not_like	string
device.modified_time	gt, gte, lt, lte	integer
device.name	eq, ne, in, not_in, like, not_like	string
device.uid	eq, ne, in, not_in, like, not_like	string
time	gt, gte, lt, lte	integer

Tanium Assets filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

[MOCK] Armis Centrix filters for `query_devices`

Field	Operators	Supported Values

[MOCK] Nozomi Vantage filters for `query_devices`

Field	Operators	Supported Values

[MOCK] Qualys VMDR filters for `query_devices`

Field	Operators	Supported Values

[MOCK] ServiceNow CMDB filters for `query_devices`

Field	Operators	Supported Values

Assets Query Filters

Armis Centrix filters for query_devices

CrowdStrike Falcon Spotlight filters for query_devices

Nozomi Vantage filters for query_devices

Qualys VMDR filters for query_devices

ServiceNow CMDB filters for query_devices

Tanium Assets filters for query_devices

[MOCK] Armis Centrix filters for query_devices

[MOCK] Nozomi Vantage filters for query_devices

[MOCK] Qualys VMDR filters for query_devices

[MOCK] ServiceNow CMDB filters for query_devices

Was this helpful?