Search query syntax

View as Markdown

The runZero search syntax works across the Asset, Service, and Wireless Inventory, across organizations and sites, and through the Query Library. The runZero Export API uses the same inventory search syntax to filter results. For ready-to-run searches built with this syntax, see the query examples.

Query syntax

Boolean operators

Combine search terms with the AND and OR operators and group them with parentheses.

AND

The Asset Inventory query os:"Windows 10" AND protocols:http AND protocols:smb2 shows only assets identified as Windows 10 where both SMB and a web server were discovered. Wrap search values that contain spaces in double quotes.

OR

By contrast, os:"Windows 10" AND protocols:http OR protocols:smb2 matches Windows 10 assets running a web server or any asset with the SMB service exposed. Besides AND and OR, the NOT operator filters a query: os:"Windows 10" AND NOT protocols:http shows Windows 10 systems without a web server. When the negation is the first term, drop the AND. The query NOT protocol:http AND os:"Windows 10" is equivalent to the previous search, with the terms reversed.

Wildcard and fuzzy searches

Most keywords are a fuzzy match by default. To force an exact, prefix, or suffix match, add the = prefix to the search term and use the % character as a wildcard. To match an operating system name of just Windows, the Asset Inventory query is os:="Windows"; for a prefix match on Ubuntu Linux, use os:="Ubuntu Linux%".

Single-character wildcard

The % wildcard matches any number of characters. To match exactly one character, use the _ single-character wildcard. For example, os:="Window%" matches both Windows and Windows 10, while os:="Window_" matches Windows but not Windows 10.

Time and date values

Search time and date (timestamp) fields with the < (less than) and > (greater than) operators to compare against the current time. Add - to compare against a relative time in the past; for example, <-3years finds timestamps from before three years ago. Supported units:

  • hours
  • minutes
  • seconds
  • months
  • years

The special value now also works.

For example, the asset search first_seen:<1year finds assets first detected within the past year. Other examples:

first_seen:<3days

first_seen:>2019-08-01

first_seen:>8/1/2019

last_seen:<1week

last_seen:<2months

last_seen:<1year

created_at:>2weeks

created_at:<30minutes

updated_at:>1year

updated_at:<12hours

os_eol:<now

os_eol:>4weeks

os_eol:<-2years

os_eol_extended:>now

os_eol_extended:>90days

Empty values

To search for an empty value, use the = prefix with nothing after it. For example, the query os:= finds assets with no identified operating system.

This works only for single-valued attributes such as os and type, not for multi-value attributes such as names or addresses.

Asset and service inventory searches

Beyond the documented keywords, Asset and Service searches support two special search types:

  • Asset Inventory searches treat unknown keywords as filters against individual Asset attributes.
  • Service Inventory searches treat unknown keywords as filters against individual Service data values.

When an Asset keyword conflicts with a Service data key, or an Asset attribute conflicts with a Service keyword, use the _asset. and _service. prefixes to disambiguate.

The two searches also differ in reach. Service queries can filter against Asset attributes (os:linux) and Service attributes (banner:Password), but Asset queries are limited to summary information about services (protocol:ssh).

Updated