Querying your data

View as Markdown

runZero gives you many ways to query your data, and queries fall into two groups:

  • Filters or parameters you type into the search bars on pages across the console, or
  • System and custom queries, whose match metrics runZero calculates as tasks complete.

Both use the same query language.

Filtering and searching data

The inventory pages are likely where you’ll use these queries most, but many other pages have the same kind of search bar for filtering results. To build a query, start with these pages:

System and custom queries

The Queries page lists all your saved queries: system queries published by runZero and custom queries created by you or your team.

Standard query attributes

Every query has these standard attributes:

  • Name: A name for the saved query.
  • Description: A description of the saved query.
  • Search query: The query or parameters to match against.
  • Search live assets only: When toggled to Yes (default), runZero adds alive:t to the search query so it includes only assets marked alive.
  • Type: The inventory the query searches.
  • Category: The category the query belongs to.
  • Severity: A severity level for the query.
  • Automatically track query results on the dashboard: When toggled to Yes, a dashboard component shows the query and its match count.

Vulnerability record attributes

Community Platform

System and custom queries can also create vulnerability records and attach them to matching assets. Some system queries have this enabled by default. To have a query create vulnerability records, switch Apply a vulnerability record to matching assets to Yes, then complete these fields:

  • Vulnerability ID: Choose a unique ID to track this vulnerability within runZero.
  • CVEs: A list of CVEs relevant to this vulnerability record (optional).
  • Solution: How this vulnerability could be remediated on assets (optional).
  • Risk: The risk level to associate with the vulnerability. This affects the asset risk.
  • Exploitable: Whether an exploit is available for the vulnerability.
  • CVSS v3 base score: The CVSS v3 base score (0.00 to 10.00).
  • CVSS v3 temporal score: The CVSS v3 temporal score (0.00 to 10.00).
  • CVSS v2 base score: The CVSS v2 base score (0.00 to 10.00).
  • CVSS v2 temporal score: The CVSS v2 temporal score (0.00 to 10.00).
  • CPE 2.3 identifier: A Common Platform Enumeration identifier in URI format (v2.3) to associate with the reported vulnerability (optional).

Creating and editing queries

Users with the default role of administrator or higher can create custom queries from the Queries page by clicking New query. You can edit and copy custom queries after creating them. System queries can’t be edited directly, but you can copy one and change the copy.

Updated