Findings

View as Markdown

When viewing findings, use these keywords to search and filter.

Finding code

Use finding_code:<uuid> to filter by the finding code field, the unique identifier for a finding.

finding_code:rz-finding-internet-exposed-database

Name

Use name:<text> to search by finding name.

name:"Internet Exposed Database"

Description

Use description:<text> to search the Description field.

description:"indicated databases"

Solution

Use solution:<text> to search the Solution field.

solution:"indicated databases"

Risk

Search the Risk / Risk Rank value with either numeric or keyword values. Risk rank is an integer from zero through four, where 0 is Info level risk and 4 is Critical risk.

risk:"Critical"

risk_rank:>2

Category

Use category:<text> to search the finding Category field.

category:"End-of-Life"

Vulnerability instance count

Use vulnerability_count:<text> to search the Instance field.

vulnerability_count:>0

Organization and site names

Use these terms to search the names of affected organizations or sites:

  • organization_name:<text>
  • site_name:<text>

The IDs are unique and are written as UUIDs.

organization_id:0eacf412-6e69-11ec-88b9-f875a414a63a

Organization and site IDs

Use these terms to search the IDs of affected organizations or sites:

  • organization_id:<uuid>
  • site_id:<uuid>

The IDs are unique and are written as UUIDs.

organization_id:0eacf412-6e69-11ec-88b9-f875a414a63a

Timestamps

Use the following keywords to search the finding timestamp fields (last_detected_at, created_at, updated_at, suppressed_at):

  • created_at:<term>
  • updated_at:<term>
  • last_detected_at:<term>
  • suppressed_at:<term>

The term supports the standard runZero time comparison syntax.

last_detected_at:>2weeks

created_at:<30minutes

updated_at:>1year

updated_at:<12hours

suppressed_at:<1day

Suppression

Use suppressed:<term> to search findings by their suppressed or unsuppressed state.

suppressed:t

matches suppressed findings.

suppressed:f

matches unsuppressed findings.

The special value any displays all records, regardless of suppression settings:

suppressed:any

displays both suppressed and unsuppressed findings.

To find the user who performed the suppression, use:

suppressed_by:<username>
Updated