Vulnerability instance inventory

View as Markdown

When viewing vulnerability instances on assets, use these keywords to search and filter.

Vulnerability ID

Use id:<uuid> to filter by the ID field, the vulnerability’s unique identifier written as a UUID.

id:a124a141-e518-4735-9878-8e89c575b1d2

Source

Use source:<name> to search or filter by the name of the source that reported the vulnerability.

source:tenable

Severity

Use severity:<term> to search the severity field.

severity:info

severity:medium

Severity score

Use severity_score:<term> to search the severity score. The term supports numerical comparison operators (>, >=, <, <=, =).

severity_score:<5.0

severity_score:>=9.0

Risk

Use risk:<term> to search the risk field.

risk:none

risk:critical

Risk score

Use risk_score:<term> to search the risk score. The term supports numerical comparison operators (>, >=, <, <=, =).

risk_score:>7.0

risk_score:=10.0

Modified risk

Use has_modified_risk:<boolean> to find vulnerabilities whose risk was modified, either manually or by an alert rule trigger.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
has_modified_risk:true

has_modified_risk:1

has_modified_risk:no

Category

Use category:<term> to search the category field.

category:Local

category:Remote

Name

Use name:<term> to search the name field.

name:"Cisco IOS Software DHCP Remote Code Execution Vulnerability"

name:"PHP < 5.3.12 / 5.4.2 CGI Query String Code Execution"

Description

Use description:<term> to search the description field.

description:"The remote device is missing a vendor-supplied security patch."

description:"remote code execution"

Solution

Use solution:<term> to search the solution field.

solution:patch

solution:upgrade

CVE

Use cve:<term> to search the CVE field.

cve:CVE-2021-44228

cve:CVE-2016-2183

KEV

Use kev:<term> to search by membership in a Known Exploited Vulnerability (KEV) list.

kev:t

matches vulnerabilities that appear on a KEV list.

You can also search a specific KEV list by name.

Exploitable

Use exploitable:<boolean> to search for exploitable vulnerabilities.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
exploitable:true

exploitable:1

exploitable:no

CVSSv2 score

Use cvss2_base_score:<term> and cvss2_temporal_score:<term> to search the CVSSv2 fields, cvss2_base_score and cvss2_temporal_score. The term supports numerical comparison operators (>, >=, <, <=, =).

cvss2_base_score:>6.5

cvss2_base_score:<=3.0

cvss2_temporal_score:=10.0

cvss2_temporal_score:<5.0

CVSSv3 score

Use cvss3_base_score:<term> and cvss3_temporal_score:<term> to search the CVSSv3 fields, cvss3_base_score and cvss3_temporal_score. The term supports numerical comparison operators (>, >=, <, <=, =).

cvss3_base_score:>6.5

cvss3_base_score:<=3.0

cvss3_temporal_score:=10.0

cvss3_temporal_score:<5.0

EPSS score

Use epss_score:<term> to search the EPSS score. The term supports numerical comparison operators (>, >=, <, <=, =).

epss_score:>0.5

epss_score:<=0.1

epss_score:=0.9

Address

Use address:<term> to search the address field.

address:192.168.0.1

Transport

Use transport:<term> to search the transport field.

transport:tcp

transport:udp

Port

Use port:<term> to search the port. The term supports numerical comparison operators (>, >=, <, <=, =).

port:22

port:443

Operating system support status

Use os_eol_expired:<boolean> to find vulnerabilities on assets based on whether their operating systems are End of Life (EOL). This field evaluates both the os_eol and os_eol_extended values and returns only vulnerabilities on assets with expired coverage.

The term is a boolean value:

  • true, t, 1, and yes represent true
  • false, f, 0, and no represent false
os_eol_expired:t

os_eol_expired:1

os_eol_expired:no

Finding code

Use finding_code:<term> to filter by the finding code field, the unique identifier for a finding.

finding_code:rz-finding-internet-exposed-database

Finding name

Use finding_name:<text> to search by finding name.

finding_name:"Internet Exposed Database"

Finding risk

Search the Finding Risk and Finding Risk Score fields with either numeric or keyword values. Risk score is an integer from zero through four, where 0 is Info level risk and 4 is Critical risk.

finding_risk:"Critical"

finding_risk:2

Detection timestamps (first detected at, last detected at)

Use first_detected_at:<term> and last_detected_at:<term> to search the timestamp fields first_detected_at and last_detected_at. The term supports the standard runZero time comparison syntax.

first_detected_at:>2weeks

first_detected_at:<30minutes

last_detected_at:>1month

last_detected_at:2hours

Publication timestamps (published at)

Use published_at:<term> to search the published_at timestamp field. The term supports the standard runZero time comparison syntax.

published_at:>2weeks

published_at:<30minutes

Timestamps (created at, updated at)

Use the following keywords to search the vulnerability timestamp fields (created_at, updated_at, suppressed_at):

  • created_at:<term>
  • updated_at:<term>
  • suppressed_at:<term>

The term supports the standard runZero time comparison syntax.

created_at:>2weeks

created_at:<30minutes

updated_at:>1month

updated_at:2hours

suppressed_at:<1day

Attributes

Use <attribute>:<term> to search any vulnerability attribute. This search term supports numerical comparison operators (>, >=, <, <=, =).

If the attribute name conflicts with an existing term, add the _vulnerability. prefix to disambiguate the query.

plugin.hasPatch:true

severityID:3

_vulnerability.state:REOPENED

Use the has:<term> keyword to check whether a vulnerability has an attribute defined. Invert the has keyword with not has:<term> to find missing fields.

has:plugin.vpr.score

not has:output

Certificate fields

Use the following keywords to search certificate-related fields.

Certificate ID

Use certificate_id:<uuid> to filter by certificate ID.

certificate_id:4e3a2b1c-5d6f-7a8b-9c0d-1e2f3a4b5c6d

Certificate type

Use certificate_type:<term> to search by certificate type.

certificate_type:"x509"

Certificate serial

Use certificate_serial:<term> to search by certificate serial number.

certificate_serial:"01A23B45C"

Certificate public key

Use certificate_public_key:<term> to search by certificate public key.

certificate_public_key:"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

Certificate public key algorithm

Use certificate_public_key_algorithm:<term> to search by certificate public key algorithm.

certificate_public_key_algorithm:"ecPublicKey"

Certificate signature

Use certificate_signature:<term> to search by certificate signature.

certificate_signature:"abcdef1234567890"

Certificate signature algorithm

Use certificate_signature_algorithm:<term> to search by certificate signature algorithm.

certificate_signature_algorithm:"rsaEncryption"

Certificate fingerprint (bkhash)

Use certificate_fp_bkhash:<term> to search by certificate fingerprint (bkhash).

certificate_fp_bkhash:"d2c7e8f9..."

Certificate fingerprint (SHA1)

Use certificate_fp_sha1:<term> to search by certificate SHA1 fingerprint.

certificate_fp_sha1:"349eb7db55bbad9d7deabc5effdfd5521ed984a0"

Certificate fingerprint (SHA256)

Use certificate_fp_sha256:<term> to search by certificate SHA256 fingerprint.

certificate_fp_sha256:"SHA256:Sc0pLUCvlNaGtu4Xy2fOTe1A6cC+KyU3x7xuN8+aLtA="

Certificate subject

Use certificate_subject:<term> to search by certificate subject.

certificate_subject:"CN=example.com,O=ExampleCorp,C=US"

Certificate common name (CN)

Use certificate_cn:<term> to search by certificate common name.

certificate_cn:"example.com"

Certificate issuer

Use certificate_issuer:<term> to search by certificate issuing authority.

certificate_issuer:"CN=Example CA,O=Example Corp,C=US"

Certificate subject key ID

Use certificate_subject_key_id:<term> to search by certificate subject key ID.

certificate_subject_key_id:"1234567890abcdef"

Certificate authority key ID

Use certificate_authority_key_id:<term> to search by certificate issuing authority key ID.

certificate_authority_key_id:"abcdef1234567890"

Suppression

Use suppressed:<term> to search vulnerabilities by their suppressed or unsuppressed state.

suppressed:t

matches suppressed vulnerabilities.

suppressed:f

matches unsuppressed vulnerabilities.

The special value any displays all records, regardless of suppression settings:

suppressed:any

displays both suppressed and unsuppressed vulnerabilities.

To find the user who performed the suppression, use:

suppressed_by:<username>
Updated