# Vulnerabilities Query Filters

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value. If a provider or operation does not support filters, it will not be listed here.

They are used in conjunction with the `filter` query parameter in the API request.

### Amazon Inspector filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |


### Axonius filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, ne, in | string |
| device.ip | eq, ne | string |
| device.last_seen_time | gte, gt | datetime |
| device.mac | eq, ne, in | string |
| device.os.name | eq, ne, in | string |
| device.os.type | eq, ne, in | string |
| device.uid | eq, ne | string |
| metadata.labels | eq | string |


### CrowdStrike Falcon® Spotlight filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.last_seen_time | gt, gte, lt, lte | datetime |
| device.mac | eq | string |
| device.uid | eq, in | string |


### Horizon3 NodeZero filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.first_seen_time | gte, gt, lte, lt | datetime |
| device.first_seen_time_dt | gte, gt, lte, lt | datetime |
| device.last_seen_time | gte, gt, lte, lt | datetime |
| device.last_seen_time_dt | gte, gt, lte, lt | datetime |


### Iru filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.first_seen_time | gte, lte | datetime |
| device.hostname | like | string |
| device.last_seen_time | gte, lte | datetime |
| device.mac | eq | string |
| device.os.type | eq | string |
| metadata.labels | eq | string |
| raw_data.* | eq, ne, gt, lt, gte, lte, like, not_like, in, not_in | string |


### Microsoft Defender External Attack Surface Management filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, ne, in, not_in | string |
| device.ip | eq, ne, in, not_in | string |
| device.name | eq, ne, in, not_in | string |
| device.type_id | eq, ne, in, not_in | string |
| metadata.labels | eq, ne, like, not_like, in, not_in | string |
| raw_data.kind | eq, ne, in | string |
| raw_data.name | eq, ne, like, in | string |
| raw_data.state | eq, ne, in | string |
| status_id | eq, ne, in, not_in | string |


### Microsoft Defender for Endpoint filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, ne, like, in | string |
| device.ip | eq, ne, in | string |
| device.last_seen_time | gte, lte | datetime |
| device.os.name | eq, ne, like, in | string |
| device.risk_level | eq, ne, in | Info, Low, Medium, High |
| device.uid | eq, in | string |
| metadata.labels | eq, like | string |
| status_code | eq, ne, in | string |


### Nucleus VM filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.uid | eq, in | string |


### Pentera filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, like, not_like | string |
| device.ip | eq, in | string |
| device.os.type | eq, in | string |
| device.uid | eq, in | string |


### Qualys VMDR filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq | string |
| device.uid | eq, in | string |
| metadata.labels | eq, in | string |


### Rapid7 InsightVM filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, in | string |
| device.ip | eq, in | string |
| device.last_seen_time | gte, lte | datetime |
| device.mac | eq, in | string |
| device.uid | eq, in | string |


### ServiceNow USEM filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.hw_info.uuid | eq, in | string |
| device.hw_info.vendor_name | eq, in, like | string |
| device.ip | eq | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq | string |
| device.name | eq | string |
| device.uid | eq, in | string |
| device.vendor_name | eq, in, like | string |
| raw_data.* | eq, in | string |


### ServiceNow Vulnerability Response filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.hw_info.uuid | eq, in | string |
| device.hw_info.vendor_name | eq, in, like | string |
| device.ip | eq | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq | string |
| device.name | eq | string |
| device.uid | eq, in | string |
| device.vendor_name | eq, in, like | string |


### Tanium VM filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, in | string |
| device.ip | eq, in | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq, in | string |
| device.uid | eq, in | string |


### Tenable ASM filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.first_seen_time | gte, lte | datetime |
| device.hostname | eq, ne, in, not_in, like, not_like | string |
| device.ip | eq, ne, in, not_in | string |
| device.last_seen_time | gte, lte | datetime |
| metadata.labels | eq, in | string |
| raw_data.* | eq, ne, gt, lt, gte, lte, like, not_like, in, not_in | string |
| raw_data.bd.record_type | eq, ne, in, not_in | A, CNAME, PTR |
| raw_data.bd.severity_ranking | eq | critical, none |


### Tenable SC filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, in | string |
| device.ip | eq, in | string |
| device.last_seen_time | gte | datetime |
| device.uid | eq, in | string |


### Tenable VM filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq | string |
| device.uid | eq, in | string |
| metadata.product.uid | eq | string |


### Wiz Vulnerabilities filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.first_seen_time | gte, lte | datetime |
| device.hostname | eq | string |
| device.modified_time | gte, lte | datetime |
| device.name | eq | string |
| device.uid | eq, in | string |
| device.uid_alt | eq, in | string |


### [MOCK] Axonius filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, ne, in | string |
| device.ip | eq, ne | string |
| device.last_seen_time | gte, gt | datetime |
| device.mac | eq, ne, in | string |
| device.os.name | eq, ne, in | string |
| device.os.type | eq, ne, in | string |
| device.uid | eq, ne | string |
| metadata.labels | eq | string |


### [MOCK] Qualys VMDR filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq | string |


### [MOCK] Rapid7 InsightVM Cloud filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq, in | string |
| device.ip | eq, in | string |
| device.last_seen_time | gte, lte | datetime |
| device.mac | eq, in | string |


### [MOCK] Tanium Vulnerability Management filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.last_seen_time | gte | datetime |
| device.mac | eq | string |


### [Mock] CrowdStrike Falcon® Spotlight filters for `query_assets`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.hostname | eq | string |
| device.ip | eq | string |
| device.last_seen_time | gt, gte, lt, lte | datetime |
| device.mac | eq | string |


### Amazon Inspector filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| severity | eq, in | Critical, High, Medium, Low, Informational |
| time | gte, lte | datetime |


### Axonius filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.desc | like | string |
| finding.first_seen_time | gte, gt, lte, lt | datetime |
| finding.last_seen_time | gte, gt, lte, lt | datetime |
| finding.title | eq, in, like | string |
| resources.labels | eq, in | string |
| resources.name | like | string |
| severity | eq, in | Critical, High, Medium, Low, Informational, Unknown |


### CrowdStrike Falcon® Spotlight filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.first_seen_time | gt, gte, lt, lte | datetime |
| finding.last_seen_time | gt, gte, lt, lte | datetime |
| finding.title | eq, in | string |
| finding.uid | eq, in | string |
| resources.labels | eq, in | string |
| severity | eq, in | critical, high, medium, low, info |


### Horizon3 NodeZero filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte, gt, lte, lt | datetime |
| finding.first_seen_time_dt | gte, gt, lte, lt | datetime |
| finding.last_seen_time | gte, gt, lte, lt | datetime |
| finding.last_seen_time_dt | gte, gt, lte, lt | datetime |
| severity | eq, ne, in | Informational, Low, Medium, High, Critical |


### Iru filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.uid | eq, in | string |
| severity | eq | Critical, High, Medium, Low |
| time | gte, lte | datetime |


### Microsoft Defender External Attack Surface Management filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| confidence | eq, in | High, Medium, Low, Unknown |
| confidence_id | eq, ne, in, not_in | number |
| finding.title | eq, ne, like, not_like, in, not_in | string |
| finding.uid | eq, ne, like, not_like, in, not_in | string |
| raw_data.priority | eq, ne, in | string |
| raw_data.remediationState | eq, ne, in | string |
| raw_data.types | eq, ne, in | string |
| severity | eq, ne, in | Critical, High, Medium, Low, Informational |
| severity_id | eq, ne, gt, gte, lt, lte, in, not_in | number |
| state_id | eq, ne, in, not_in | number |


### Microsoft Defender for Endpoint filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.desc | eq, like | string |
| finding.first_seen_time | gt, gte, lt, lte | datetime |
| finding.last_seen_time | gt, gte, lt, lte | datetime |
| finding.title | eq, like | string |
| finding.uid | eq, in, like | string |
| resources.name | eq, ne, like, in | string |
| severity | eq, ne, in | Critical, High, Medium, Low, Informational |


### Nucleus VM filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.last_seen_time | gte, lte, gt, lt | datetime |
| resources.ip | eq | string |
| resources.name | eq | string |
| severity | eq | critical, high, medium, low, info |


### Pentera filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.created_time | gte, gt, lte, lt | datetime |
| finding.created_time_dt | gte, gt, lte, lt | datetime |
| finding.last_seen_time | gte, gt, lte, lt | datetime |
| finding.last_seen_time_dt | gte, gt, lte, lt | datetime |
| finding.title | eq, like, not_like | string |
| raw_data.vulnerability.priority | eq, ne, in | string |
| raw_data.vulnerability.protocol | eq, ne, in | string |
| raw_data.vulnerability.severity | eq, ne, in | string |
| risk_level | eq, ne, in | Low, Medium, High, Critical, Unknown |
| severity | eq, ne, in | Informational, Low, Medium, High, Critical, Unknown |
| severity_id | eq | 0, 1, 2, 3, 4, 5 |
| time | gte, gt, lte, lt | datetime |
| time_dt | gte, gt, lte, lt | datetime |


### Qualys VMDR filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| resources.ip | eq, in | string |
| resources.labels | eq, in | string |
| severity | eq, in | critical, high, medium, low, info |


### Rapid7 InsightVM filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.uid | eq, in, like | string |
| resources.ip | eq, in | string |
| resources.last_seen_time | gte, lte | datetime |
| resources.name | eq, in, like | string |
| severity | eq, in | critical, high, medium, low, info |


### ServiceNow USEM filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.created_time | gte, lte | datetime |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.modified_time | gte, lte | datetime |
| finding.title | eq, in, like | string |
| finding.uid | eq, in | string |
| raw_data.* | eq, in | string |
| resources.ip | eq, in | string |
| resources.last_seen_time | gte, lte | datetime |
| resources.mac | eq, in | string |
| resources.name | eq, in | string |
| resources.vendor_name | eq, in, like | string |
| resources.vendor_uuid | eq, in | string |
| severity | eq, in | Critical, High, Medium, Low, Info |


### ServiceNow Vulnerability Response filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.created_time | gte, lte | datetime |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.modified_time | gte, lte | datetime |
| finding.title | eq, in, like | string |
| finding.uid | eq, in | string |
| resources.ip | eq, in | string |
| resources.last_seen_time | gte, lte | datetime |
| resources.mac | eq, in | string |
| resources.name | eq, in | string |
| resources.vendor_name | eq, in, like | string |
| resources.vendor_uuid | eq, in | string |
| severity | eq, in | critical, high, medium, low, info |


### Tanium VM filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.desc | eq, like | string |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.title | eq, like | string |
| finding.uid | eq, in, like | string |
| resources.ip | eq, in | string |
| resources.last_seen_time | gte | datetime |
| resources.mac | eq, in | string |
| resources.name | eq, in | string |
| resources.os_type | eq, in | string |
| severity | eq, in | critical, high, medium, low, info, unknown |


### Tenable ASM filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.last_seen_time | gte, lte | datetime |
| finding.title | eq, in, like | string |
| raw_data.* | eq, ne, gt, lt, gte, lte, like, not_like, in, not_in | string |
| raw_data.bd.record_type | eq, ne, in, not_in | A, CNAME, PTR |
| resources.ip | eq, ne, in, not_in | string |
| resources.labels | eq, in | string |
| resources.name | eq, ne, like, in, not_in | string |


### Tenable SC filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| device.uid | eq, in | string |
| finding.first_seen_time | gte | datetime |
| finding.last_seen_time | gte | datetime |
| finding.uid | eq, in | string |
| severity | eq, in | Critical, High, Medium, Low, Informational |


### Tenable VM filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte | datetime |
| finding.last_seen_time | gte | datetime |
| metadata.uid | eq | string |
| severity | eq, in | critical, high, medium, low, info |


### Wiz Vulnerabilities filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte, lte | datetime |
| resources.labels | eq, in | string |
| severity | eq, in | Critical, High, Medium, Low, Informational |
| state | eq, in | New, Resolved, Suppressed |


### [MOCK] Axonius filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.desc | like | string |
| finding.first_seen_time | gte, gt, lte, lt | datetime |
| finding.last_seen_time | gte, gt, lte, lt | datetime |
| finding.title | eq, in, like | string |
| resources.labels | eq, in | string |
| resources.name | like | string |
| severity | eq, in | Critical, High, Medium, Low, Informational, Unknown |


### [MOCK] Qualys VMDR filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| severity | eq, in | critical, high, medium, low, info |


### [MOCK] Rapid7 InsightVM Cloud filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.uid | eq, in, like | string |
| resources.ip | eq, in | string |
| resources.last_seen_time | gte, lte | datetime |
| resources.name | eq, in, like | string |
| severity | eq, in | critical, high, medium, low, info |


### [MOCK] Tanium Vulnerability Management filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.desc | eq, like | string |
| finding.first_seen_time | gte, lte | datetime |
| finding.last_seen_time | gte, lte | datetime |
| finding.title | eq, like | string |
| finding.uid | eq, in, like | string |
| resources.ip | eq, in | string |
| resources.last_seen_time | gte | datetime |
| resources.mac | eq, in | string |
| resources.name | eq, in | string |
| resources.os_type | eq, in | string |
| severity | eq, in | critical, high, medium, low, info, unknown |


### [Mock] CrowdStrike Falcon® Spotlight filters for `query_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.first_seen_time | gt, gte, lt, lte | datetime |
| finding.last_seen_time | gt, gte, lt, lte | datetime |
| severity | eq, in | critical, high, medium, low, info |


### Pentera filters for `query_scan_findings`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| finding.title | eq, like, not_like | string |
| severity | eq, ne, in | Informational, Low, Medium, High, Critical, Unknown |
| severity_id | eq | 0, 1, 2, 3, 4, 5 |


### Pentera filters for `query_scans`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| raw_data.score | eq, in | string |
| raw_data.status | eq, in | string |
| raw_data.type | eq, in | string |
| status | eq, in | Success, Failure |
| time | gte, gt, lte, lt | datetime |
| time_dt | gte, gt, lte, lt | datetime |


### Tenable VM filters for `query_scans`

| Field | Operators | Supported Values |
|  --- | --- | --- |
| name | eq | string |
| uid | eq | string |