Vulnerabilities Query Filters

This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value. If a provider or operation does not support filters, it will not be listed here.

They are used in conjunction with the filter query parameter in the API request.

Amazon Inspector filters for `query_assets`

Field	Operators	Supported Values
device.uid	eq, in	string

Axonius filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, ne, in	string
device.ip	eq, ne	string
device.mac	eq, ne, in	string
device.os.name	eq, ne, in	string
device.os.type	eq, ne, in	string
device.uid	eq, ne	string
metadata.labels	eq	string

CrowdStrike Falcon® Spotlight filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gt, gte, lt, lte	datetime
device.mac	eq	string
device.uid	eq, in	string

Horizon3 NodeZero filters for `query_assets`

Field	Operators	Supported Values
device.first_seen_time	gte, gt, lte, lt	datetime
device.first_seen_time_dt	gte, gt, lte, lt	datetime
device.last_seen_time	gte, gt, lte, lt	datetime
device.last_seen_time_dt	gte, gt, lte, lt	datetime

Iru filters for `query_assets`

Field	Operators	Supported Values
device.first_seen_time	gte, lte	datetime
device.hostname	like	string
device.last_seen_time	gte, lte	datetime
device.mac	eq	string
device.os.type	eq	string
metadata.labels	eq	string
raw_data.*	eq, ne, gt, lt, gte, lte, like, not_like, in, not_in	string

Microsoft Defender External Attack Surface Management filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, ne, in, not_in	string
device.ip	eq, ne, in, not_in	string
device.name	eq, ne, in, not_in	string
device.type_id	eq, ne, in, not_in	string
metadata.labels	eq, ne, like, not_like, in, not_in	string
raw_data.kind	eq, ne, in	string
raw_data.name	eq, ne, like, in	string
raw_data.state	eq, ne, in	string
status_id	eq, ne, in, not_in	string

Microsoft Defender for Endpoint filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, ne, like, in	string
device.ip	eq, ne, in	string
device.last_seen_time	gte, lte	datetime
device.os.name	eq, ne, like, in	string
device.risk_level	eq, ne, in	Info, Low, Medium, High
device.uid	eq, in	string
metadata.labels	eq, like	string
status_code	eq, ne, in	string

Nucleus VM filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.uid	eq, in	string

Pentera filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, like, not_like	string
device.ip	eq, in	string
device.os.type	eq, in	string

Qualys VMDR filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string
device.uid	eq, in	string
metadata.labels	eq, in	string

Rapid7 InsightVM filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, in	string
device.ip	eq, in	string
device.last_seen_time	gte, lte	datetime
device.mac	eq, in	string
device.uid	eq, in	string

ServiceNow Vulnerability Response filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.hw_info.uuid	eq, in	string
device.hw_info.vendor_name	eq, in, like	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string
device.name	eq	string
device.uid	eq, in	string
device.vendor_name	eq, in, like	string

Tanium VM filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, in	string
device.ip	eq, in	string
device.last_seen_time	gte	datetime
device.mac	eq, in	string
device.uid	eq, in	string

Tenable SC filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, in	string
device.ip	eq, in	string
device.last_seen_time	gte	datetime
device.uid	eq, in	string

Tenable VM filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string
device.uid	eq, in	string
metadata.product.uid	eq	string

Wiz Vulnerabilities filters for `query_assets`

Field	Operators	Supported Values
device.first_seen_time	gte, lte	datetime
device.hostname	eq	string
device.name	eq	string
device.uid	eq, in	string
device.uid_alt	eq, in	string

[MOCK] Axonius filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, ne, in	string
device.ip	eq, ne	string
device.mac	eq, ne, in	string
device.os.name	eq, ne, in	string
device.os.type	eq, ne, in	string
device.uid	eq, ne	string
metadata.labels	eq	string

[MOCK] Qualys VMDR filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

[MOCK] Rapid7 InsightVM Cloud filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq, in	string
device.ip	eq, in	string
device.last_seen_time	gte, lte	datetime
device.mac	eq, in	string

[MOCK] Tanium Vulnerability Management filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gte	datetime
device.mac	eq	string

[Mock] CrowdStrike Falcon® Spotlight filters for `query_assets`

Field	Operators	Supported Values
device.hostname	eq	string
device.ip	eq	string
device.last_seen_time	gt, gte, lt, lte	datetime
device.mac	eq	string

Amazon Inspector filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
severity	eq, in	Critical, High, Medium, Low, Informational
time	gte, lte	datetime

Axonius filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.desc	like	string
finding.first_seen_time	gte, gt, lte, lt	datetime
finding.last_seen_time	gte, gt, lte, lt	datetime
finding.title	eq, in, like	string
resources.labels	eq, in	string
resources.name	like	string
severity	eq, in	Critical, High, Medium, Low, Informational, Unknown

CrowdStrike Falcon® Spotlight filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.first_seen_time	gt, gte, lt, lte	datetime
finding.last_seen_time	gt, gte, lt, lte	datetime
finding.uid	eq, in	string
resources.labels	eq, in	string
severity	eq, in	critical, high, medium, low, info

Horizon3 NodeZero filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte, gt, lte, lt	datetime
finding.first_seen_time_dt	gte, gt, lte, lt	datetime
finding.last_seen_time	gte, gt, lte, lt	datetime
finding.last_seen_time_dt	gte, gt, lte, lt	datetime
severity	eq, ne, in	Informational, Low, Medium, High, Critical

Iru filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
finding.uid	eq, in	string
severity	eq	Critical, High, Medium, Low
time	gte, lte	datetime

Microsoft Defender External Attack Surface Management filters for `query_findings`

Field	Operators	Supported Values
confidence	eq, in	High, Medium, Low, Unknown
confidence_id	eq, ne, in, not_in	number
finding.title	eq, ne, like, not_like, in, not_in	string
finding.uid	eq, ne, like, not_like, in, not_in	string
raw_data.priority	eq, ne, in	string
raw_data.remediationState	eq, ne, in	string
raw_data.types	eq, ne, in	string
severity	eq, ne, in	Critical, High, Medium, Low, Informational
severity_id	eq, ne, gt, gte, lt, lte, in, not_in	number
state_id	eq, ne, in, not_in	number

Microsoft Defender for Endpoint filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.desc	eq, like	string
finding.first_seen_time	gt, gte, lt, lte	datetime
finding.last_seen_time	gt, gte, lt, lte	datetime
finding.title	eq, like	string
finding.uid	eq, in, like	string
resources.name	eq, ne, like, in	string
severity	eq, ne, in	Critical, High, Medium, Low, Informational

Nucleus VM filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.last_seen_time	gte, lte, gt, lt	datetime
resources.ip	eq	string
resources.name	eq	string
severity	eq	critical, high, medium, low, info

Pentera filters for `query_findings`

Field	Operators	Supported Values
finding.created_time	gte, gt, lte, lt	datetime
finding.created_time_dt	gte, gt, lte, lt	datetime
finding.title	eq, like, not_like	string
raw_data.vulnerability.priority	eq, ne, in	string
raw_data.vulnerability.protocol	eq, ne, in	string
raw_data.vulnerability.severity	eq, ne, in	string
risk_level	eq, ne, in	Low, Medium, High, Critical, Unknown
severity	eq, ne, in	Informational, Low, Medium, High, Critical, Unknown
severity_id	eq	0, 1, 2, 3, 4, 5
time	gte, gt, lte, lt	datetime
time_dt	gte, gt, lte, lt	datetime

Qualys VMDR filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
resources.ip	eq, in	string
resources.labels	eq, in	string
severity	eq, in	critical, high, medium, low, info

Rapid7 InsightVM filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
finding.uid	eq, in, like	string
resources.ip	eq, in	string
resources.last_seen_time	gte, lte	datetime
resources.name	eq, in, like	string
severity	eq, in	critical, high, medium, low, info

ServiceNow Vulnerability Response filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.created_time	gte, lte	datetime
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
finding.modified_time	gte, lte	datetime
finding.title	eq, in, like	string
finding.uid	eq, in	string
resources.ip	eq, in	string
resources.last_seen_time	gte, lte	datetime
resources.mac	eq, in	string
resources.name	eq, in	string
resources.vendor_name	eq, in, like	string
resources.vendor_uuid	eq, in	string
severity	eq, in	critical, high, medium, low, info

Tanium VM filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.desc	eq, like	string
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
finding.title	eq, like	string
finding.uid	eq, in, like	string
resources.ip	eq, in	string
resources.last_seen_time	gte	datetime
resources.mac	eq, in	string
resources.name	eq, in	string
resources.os_type	eq, in	string
severity	eq, in	critical, high, medium, low, info, unknown

Tenable SC filters for `query_findings`

Field	Operators	Supported Values
device.uid	eq, in	string
finding.first_seen_time	gte	datetime
finding.last_seen_time	gte	datetime
finding.uid	eq, in	string
severity	eq, in	Critical, High, Medium, Low, Informational

Tenable VM filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte	datetime
finding.last_seen_time	gte	datetime
metadata.uid	eq	string
severity	eq, in	critical, high, medium, low, info

Wiz Vulnerabilities filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte, lte	datetime
resources.labels	eq, in	string
severity	eq, in	Critical, High, Medium, Low, Informational
state	eq, in	New, Resolved, Suppressed

[MOCK] Axonius filters for `query_findings`

Field	Operators	Supported Values
finding.desc	like	string
finding.first_seen_time	gte, gt, lte, lt	datetime
finding.last_seen_time	gte, gt, lte, lt	datetime
finding.uid	eq, in, like	string
resources.labels	eq, in	string
resources.name	like	string
severity	eq, in	Critical, High, Medium, Low, Informational, Unknown

[MOCK] Qualys VMDR filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
severity	eq, in	critical, high, medium, low, info

[MOCK] Rapid7 InsightVM Cloud filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
finding.uid	eq, in, like	string
resources.ip	eq, in	string
resources.last_seen_time	gte, lte	datetime
resources.name	eq, in, like	string
severity	eq, in	critical, high, medium, low, info

[MOCK] Tanium Vulnerability Management filters for `query_findings`

Field	Operators	Supported Values
finding.desc	eq, like	string
finding.first_seen_time	gte, lte	datetime
finding.last_seen_time	gte, lte	datetime
finding.title	eq, like	string
finding.uid	eq, in, like	string
resources.ip	eq, in	string
resources.last_seen_time	gte	datetime
resources.mac	eq, in	string
resources.name	eq, in	string
resources.os_type	eq, in	string
severity	eq, in	critical, high, medium, low, info, unknown

[Mock] CrowdStrike Falcon® Spotlight filters for `query_findings`

Field	Operators	Supported Values
finding.first_seen_time	gt, gte, lt, lte	datetime
finding.last_seen_time	gt, gte, lt, lte	datetime
severity	eq, in	critical, high, medium, low, info

Pentera filters for `query_scan_findings`

Field	Operators	Supported Values
finding.title	eq, like, not_like	string
severity	eq, ne, in	Informational, Low, Medium, High, Critical, Unknown
severity_id	eq	0, 1, 2, 3, 4, 5

Pentera filters for `query_scans`

Field	Operators	Supported Values
raw_data.score	eq, in	string
raw_data.status	eq, in	string
raw_data.type	eq, in	string
status	eq, in	Success, Failure
time	gte, gt, lte, lt	datetime
time_dt	gte, gt, lte, lt	datetime

Tenable VM filters for `query_scans`

Field	Operators	Supported Values
name	eq	string
uid	eq	string

Vulnerabilities Query Filters

Amazon Inspector filters for query_assets

Axonius filters for query_assets

CrowdStrike Falcon® Spotlight filters for query_assets

Horizon3 NodeZero filters for query_assets

Iru filters for query_assets

Microsoft Defender External Attack Surface Management filters for query_assets

Microsoft Defender for Endpoint filters for query_assets

Nucleus VM filters for query_assets

Pentera filters for query_assets

Qualys VMDR filters for query_assets

Rapid7 InsightVM filters for query_assets

ServiceNow Vulnerability Response filters for query_assets

Tanium VM filters for query_assets

Tenable SC filters for query_assets

Tenable VM filters for query_assets

Wiz Vulnerabilities filters for query_assets

[MOCK] Axonius filters for query_assets

[MOCK] Qualys VMDR filters for query_assets

[MOCK] Rapid7 InsightVM Cloud filters for query_assets

[MOCK] Tanium Vulnerability Management filters for query_assets

[Mock] CrowdStrike Falcon® Spotlight filters for query_assets

Amazon Inspector filters for query_findings

Axonius filters for query_findings

CrowdStrike Falcon® Spotlight filters for query_findings

Horizon3 NodeZero filters for query_findings

Iru filters for query_findings

Microsoft Defender External Attack Surface Management filters for query_findings

Microsoft Defender for Endpoint filters for query_findings

Nucleus VM filters for query_findings

Pentera filters for query_findings

Qualys VMDR filters for query_findings

Rapid7 InsightVM filters for query_findings

ServiceNow Vulnerability Response filters for query_findings

Tanium VM filters for query_findings

Tenable SC filters for query_findings

Tenable VM filters for query_findings

Wiz Vulnerabilities filters for query_findings

[MOCK] Axonius filters for query_findings

[MOCK] Qualys VMDR filters for query_findings

[MOCK] Rapid7 InsightVM Cloud filters for query_findings

[MOCK] Tanium Vulnerability Management filters for query_findings

[Mock] CrowdStrike Falcon® Spotlight filters for query_findings

Pentera filters for query_scan_findings

Pentera filters for query_scans

Tenable VM filters for query_scans

Was this helpful?