Assets Query Filters

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value. If a provider or operation does not support filters, it will not be listed here.

They are used in conjunction with the filter query parameter in the API request.

Armis Centrix™ filters for `query_devices`

Field	Operators	Supported Values
device.hw_info.bios_manufacturer	eq, ne, in, not_in	string
device.ip	eq, ne, in, not_in	string
device.location.desc	eq, ne, in, not_in	string
device.mac	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in, like, not_like	string
device.os.version	eq, ne, in, not_in	string
device.risk_score	gt, gte, lt, lte	number
device.type	eq, ne, in, not_in	string
device.uid	eq, ne, in, not_in	string

Axonius filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, in	string
device.ip	eq, ne	string
device.mac	eq, ne, in	string
device.os.name	eq, ne, in	string
device.os.type	eq, ne, in	string
device.uid	eq, ne	string
metadata.labels	eq	string

Claroty xDome filters for `query_devices`

Field	Operators	Supported Values
device.hostname	in, not_in, like, not_like	string
device.ip	in, not_in	string
device.last_seen_time	gt, lt	datetime
device.mac	in, not_in	string
device.os.name	in, not_in	string
device.os.type	in, not_in	string
device.uid	in, not_in	string
metadata.labels	in	string

CrowdStrike Falcon Spotlight filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gt, gte, lt, lte	datetime
device.mac	eq	string
metadata.labels	eq, in	string

Iru filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gte, lte	datetime
device.first_seen_time_dt	gte, lte	datetime
device.groups.uid	eq	string
device.hostname	like	string
device.hw_info.serial_number	eq	string
device.last_seen_time	gte, lte	datetime
device.last_seen_time_dt	gte, lte	datetime
device.mac	eq	string
device.os.type	eq	string
device.os.version	eq	string
device.owner.full_name	like	string
metadata.labels	eq	string
raw_data.*	eq, ne, gt, lt, gte, lte, like, not_like, in, not_in	string

Ivanti Neurons filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, like, not_like	string
device.ip	eq, ne, like, not_like	string
device.last_seen_time	eq, gt, gte, lt, lte	string
device.mac	eq, ne, like, not_like	string
device.os.name	eq, ne, like, not_like	string
device.os.type	eq, ne, like, not_like	string
device.uid	eq, ne, like, not_like	string

JupiterOne filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gte, lte	string
device.hostname	eq, ne, like	string
device.ip	eq	string
device.last_seen_time	gte, lte	string
device.mac	eq	string
device.name	eq, ne, like	string
device.os.name	eq, ne, like	string
device.uid	eq, ne	string
raw_data.*	eq, ne, like, not_like, in, not_in	string

Microsoft Defender for Endpoint filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, like, in	string
device.ip	eq, ne, in	string
device.last_seen_time	gte, lte	datetime
device.os.name	eq, ne, like, in	string
device.risk_level	eq, ne, in	Info, Low, Medium, High
device.uid	eq, in	string
metadata.labels	eq, like	string
status_code	eq, ne, in	string

Nozomi Vantage filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gt, gte, lt, lte	number
device.hw_info.serial_number	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, in, not_in	string
device.ip_addresses	eq, ne, in, not_in	string
device.last_seen_time	gt, gte, lt, lte	number
device.mac	eq, ne, in, not_in	string
device.mac_addresses	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in, like, not_like	string
device.network_interfaces.name	eq, ne, in, not_in	string
device.risk_level_id	eq, ne, in, not_in	0, 1, 2, 3, 4
device.risk_score	gt, gte, lt, lte	number
device.type	eq, ne, in, not_in, like, not_like	string
device.type_id	eq, ne, in, not_in	2, 4, 5, 10, 89, 90, 96
device.uid	eq, ne, in, not_in, like, not_like	string
device.vendor.name	eq, ne, in, not_in, like, not_like	string
time	gt, gte, lt, lte	datetime

Qualys VMDR filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string
metadata.labels	eq, in	string

ServiceNow CMDB filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gt, gte, lt, lte	number
device.hostname	eq, ne, in, not_in, like, not_like	string
device.hw_info.serial_number	eq, ne, in, not_in, like, not_like	string
device.hw_info.uuid	eq, in	string
device.hw_info.vendor_name	eq, in, like	string
device.ip	eq, ne, in, not_in, like, not_like	string
device.last_seen_time	gt, gte, lt, lte	number
device.mac	eq, ne, in, not_in, like, not_like	string
device.modified_time	gt, gte, lt, lte	number
device.name	eq, ne, in, not_in, like, not_like	string
device.uid	eq, ne, in, not_in, like, not_like	string
device.vendor_name	eq, in, like	string
metadata.labels	eq, in	string
time	gt, gte, lt, lte	datetime

Sevco filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, gt, gte, lt, lte	string
device.last_seen_time	eq, ne, gt, gte, lt, lte	string
device.mac	eq, ne	string
device.os.name	eq, ne, in, not_in, like, not_like	string
device.os.type_id	eq, ne	string
device.uid	eq	string

Tanium Assets filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

Tenable Cloud filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, in	string
device.ip	eq, in	string
device.last_seen_time	gte	datetime
device.mac	eq, in	string
device.uid	eq, in	string
metadata.labels	eq, in	string

[MOCK] Armis Centrix filters for `query_devices`

Field	Operators	Supported Values
device.hw_info.bios_manufacturer	eq, ne, in, not_in	string
device.ip	eq, ne, in, not_in	string
device.location.desc	eq, ne, in, not_in	string
device.mac	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in, like, not_like	string
device.os.version	eq, ne, in, not_in	string
device.risk_score	gt, gte, lt, lte	number
device.type	eq, ne, in, not_in	string
device.uid	eq, ne, in, not_in	string

[MOCK] Axonius filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, in	string
device.ip	eq, ne	string
device.mac	eq, ne, in	string
device.os.name	eq, ne, in	string
device.os.type	eq, ne, in	string
device.uid	eq, ne	string
metadata.labels	eq	string

[MOCK] CrowdStrike Falcon Spotlight filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gt, gte, lt, lte	datetime
device.mac	eq	string

[MOCK] Ivanti Neurons filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, like, not_like	string
device.ip	eq, ne, like, not_like	string
device.last_seen_time	eq, gt, gte, lt, lte	string
device.mac	eq, ne, like, not_like	string
device.os.name	eq, ne, like, not_like	string
device.os.type	eq, ne, like, not_like	string
device.uid	eq, ne, like, not_like	string

[MOCK] Nozomi Vantage filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gt, gte, lt, lte	number
device.hw_info.serial_number	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, in, not_in	string
device.ip_addresses	eq, ne, in, not_in	string
device.last_seen_time	gt, gte, lt, lte	number
device.mac	eq, ne, in, not_in	string
device.mac_addresses	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in, like, not_like	string
device.network_interfaces.name	eq, ne, in, not_in	string
device.risk_level_id	eq, ne, in, not_in	0, 1, 2, 3, 4
device.risk_score	gt, gte, lt, lte	number
device.type	eq, ne, in, not_in, like, not_like	string
device.type_id	eq, ne, in, not_in	2, 4, 5, 10, 89, 90, 96
device.uid	eq, ne, in, not_in, like, not_like	string
device.vendor.name	eq, ne, in, not_in, like, not_like	string
time	gt, gte, lt, lte	datetime

[MOCK] Qualys VMDR filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

[MOCK] ServiceNow CMDB filters for `query_devices`

Field	Operators	Supported Values
device.first_seen_time	gt, gte, lt, lte	number
device.hostname	eq, ne, in, not_in, like, not_like	string
device.hw_info.serial_number	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, in, not_in, like, not_like	string
device.last_seen_time	gt, gte, lt, lte	number
device.mac	eq, ne, in, not_in, like, not_like	string
device.modified_time	gt, gte, lt, lte	number
device.name	eq, ne, in, not_in, like, not_like	string
device.uid	eq, ne, in, not_in, like, not_like	string
time	gt, gte, lt, lte	datetime

[MOCK] Sevco filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq, ne, in, not_in, like, not_like	string
device.ip	eq, ne, gt, gte, lt, lte	string
device.last_seen_time	eq, ne, gt, gte, lt, lte	string
device.mac	eq, ne	string
device.os.name	eq, ne, in, not_in, like, not_like	string
device.os.type_id	eq, ne	string
device.uid	eq	string

[MOCK] Tanium Assets filters for `query_devices`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

Axonius filters for `query_software`

Field	Operators	Supported Values
device.hostname	eq, ne, in	string
device.ip	eq, ne	string
device.mac	eq, ne, in	string
device.os.name	eq, ne, in	string
device.os.type	eq, ne, in	string
device.uid	eq, ne	string
metadata.labels	eq	string
package.cpe_name	eq, ne, in	string
package.name	eq, ne, in	string
package.vendor_name	eq, ne, in	string
package.version	eq, ne, in	string

CrowdStrike Falcon Spotlight filters for `query_software`

Field	Operators	Supported Values
device.hostname	eq, ne, in, not_in	string
device.ip	eq, ne, in, not_in	string
device.mac	eq, ne, in, not_in	string
device.os.name	eq, ne, in, not_in	string
device.os.type	eq, ne, in, not_in	string
device.os.type_id	eq, ne, in, not_in	string
device.os.version	eq, ne, in, not_in	string
device.type	eq, ne, in, not_in	string
device.type_id	eq, ne, in, not_in	string
device.uid	eq, ne, in, not_in	string
metadata.modified_time	gt, gte, lt, lte	datetime
metadata.modified_time_dt	gt, gte, lt, lte	datetime
package.name	eq, ne, in, not_in	string
package.path	eq, ne, in, not_in	string
package.uid	eq, ne, in, not_in	string
package.vendor_name	eq, ne, in, not_in	string
package.version	eq, ne, in, not_in	string
start_time	gt, gte, lt, lte	datetime
start_time_dt	gt, gte, lt, lte	datetime
time	gt, gte, lt, lte	datetime
time_dt	gt, gte, lt, lte	datetime

Ivanti Neurons filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.name	eq, in	string
package.vendor_name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

JupiterOne filters for `query_software`

Field	Operators	Supported Values
device.hostname	eq, ne, like	string
device.uid	eq, ne	string
package.name	eq, ne, like	string
package.vendor_name	eq, ne, like	string
package.version	eq, ne	string
raw_data.*	eq, ne, like, not_like, in, not_in	string

Tanium Assets filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

Tenable Cloud filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.cpe_name	eq, in	string
package.name	eq, in	string
package.vendor_name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

[MOCK] Axonius filters for `query_software`

Field	Operators	Supported Values
device.hostname	eq, ne, in	string
device.ip	eq, ne	string
device.mac	eq, ne, in	string
device.os.name	eq, ne, in	string
device.os.type	eq, ne, in	string
device.uid	eq, ne	string
metadata.labels	eq	string
package.cpe_name	eq, ne, in	string
package.name	eq, ne, in	string
package.vendor_name	eq, ne, in	string
package.version	eq, ne, in	string

[MOCK] CrowdStrike Falcon Spotlight filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.name	eq, in	string
package.vendor_name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

[MOCK] Ivanti Neurons filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.name	eq, in	string
package.vendor_name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

[MOCK] Tanium Assets filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

[MOCK] Tenable Cloud filters for `query_software`

Field	Operators	Supported Values
device.uid	eq, in	string
package.cpe_name	eq, in	string
package.name	eq, in	string
package.vendor_name	eq, in	string
package.version	eq, in	string
time	gte, lte	datetime

Assets Query Filters

Armis Centrix™ filters for query_devices

Axonius filters for query_devices

Claroty xDome filters for query_devices

CrowdStrike Falcon Spotlight filters for query_devices

Iru filters for query_devices

Ivanti Neurons filters for query_devices

JupiterOne filters for query_devices

Microsoft Defender for Endpoint filters for query_devices

Nozomi Vantage filters for query_devices

Qualys VMDR filters for query_devices

ServiceNow CMDB filters for query_devices

Sevco filters for query_devices

Tanium Assets filters for query_devices

Tenable Cloud filters for query_devices

[MOCK] Armis Centrix filters for query_devices

[MOCK] Axonius filters for query_devices

[MOCK] CrowdStrike Falcon Spotlight filters for query_devices

[MOCK] Ivanti Neurons filters for query_devices

[MOCK] Nozomi Vantage filters for query_devices

[MOCK] Qualys VMDR filters for query_devices

[MOCK] ServiceNow CMDB filters for query_devices

[MOCK] Sevco filters for query_devices

[MOCK] Tanium Assets filters for query_devices

Axonius filters for query_software

CrowdStrike Falcon Spotlight filters for query_software

Ivanti Neurons filters for query_software

JupiterOne filters for query_software

Tanium Assets filters for query_software

Tenable Cloud filters for query_software

[MOCK] Axonius filters for query_software

[MOCK] CrowdStrike Falcon Spotlight filters for query_software

[MOCK] Ivanti Neurons filters for query_software

[MOCK] Tanium Assets filters for query_software

[MOCK] Tenable Cloud filters for query_software

Was this helpful?