Vulnerabilities inventory

View as Markdown

When viewing vulnerability groups, use these keywords to search and filter.

Name

Use name:<term> to search the name field.

name:"Cisco IOS Software DHCP Remote Code Execution Vulnerability"

name:"PHP < 5.3.12 / 5.4.2 CGI Query String Code Execution"

CVE

Use cve:<term> to search the CVE field.

cve:CVE-2021-44228

cve:CVE-2016-2183

KEV

Use kev:<term> to search by membership in a Known Exploited Vulnerability (KEV) list.

kev:t

matches vulnerabilities that appear on a KEV list.

You can also search a specific KEV list by name.

Severity

Use severity:<term> to search the severity field.

severity:info

severity:medium

Risk

Search the Risk and Risk Score fields with either numeric or keyword values. Risk score is an integer from zero through four, where 0 is Info level risk and 4 is Critical risk.

risk:"Critical"

risk:2

Vulnerability instance count

Use count:<text> to search the Asset count field.

count:>0

Site name or ID

Use site:<term> to filter by site name or ID.

site:Primary

EPSS score

Use epss_score:<term> to search the EPSS score. The term supports numerical comparison operators (>, >=, <, <=, =).

epss_score:>0.5

epss_score:<=0.1

epss_score:=0.9

Timestamps

Use the following keywords to search the vulnerability group timestamp fields (created_at, suppressed_at):

  • created_at:<term>
  • suppressed_at:<term>

The term supports the standard runZero time comparison syntax.

created_at:>2weeks

created_at:<30minutes

suppressed_at:<1day

Suppression

Use suppressed:<term> to search vulnerability groups by their suppressed or unsuppressed state.

suppressed:t

matches suppressed vulnerability groups.

suppressed:f

matches unsuppressed vulnerability groups.

The special value any displays all records, regardless of suppression settings:

suppressed:any

displays both suppressed and unsuppressed vulnerability groups.

To find the user who performed the suppression, use:

suppressed_by:<username>
Updated