Query operators

Overview

Several program features rely on asset and vulnerability filtering in order to refine presented data or determine the scope of projects and triggers. To this end, InsightVM offers its own query language that you can use to filter your data in as broad or specific terms as you need. This guide explains the query building process using the Query Builder, a cloud-based InsightVM feature.

Queries are used with the following InsightVM features:

Operators

The following operators are available for use when building queries in Standard or Expert mode in the Query Builder.

NOTE

The list of usable operators shown will depend on which parameter you have selected beforehand.

Standard Mode

Use these operators in Standard mode.

Operator

Description

=

Equal to - returns all records that equal the specified value.

!=

Not Equal to - returns all records that are not equal to the specified value.

CONTAINS

Returns all records that include the specified string.

DOES NOT CONTAIN

Returns all records that do not include the specified string.

STARTS WITH

Returns all records that start with the specified string.

ENDS WITH

Returns all records that end with the specified string.

LIKE

Returns all records that match a search pattern defined by a regular expression.Returns all records that contain the specified string.

IS

Returns all records whose specified value is NULL (contains the NULL value).

IS NOT

Returns all records whose specified value is not NULL (contains the NULL value).

AND

The AND operator returns values when both conditions are true.

OR

The OR operator returns values when one of the conditions is true.

~>

Returns any object with any field that matches the specified string.

Expert Mode

Use these operators in Expert mode.

Operator

Description

=

Equal to - returns all records that equal the specified value.

!=

Not equal to - returns all records that are not equal to the specified value.

>

Greater than - returns all records that are greater than the specified value.

>=

Greater than or equal to - returns all records that are greater than or equal to the specified value.

<

Less than - returns all records that are less than the specified value.

<=

Less than or equal to - returns all records that are less than or equal to the specified value.

CONTAINS

Returns all records that contain the specified string.

DOES NOT CONTAIN

Returns all records that do not include the specified string.

STARTS WITH

Returns all records that start with the specified string.

ENDS WITH

Returns all records that end with the specified string.

LIKE

Returns all records that match a search pattern defined by a regular expression.

IS

Returns all records whose specified value is NULL (contains the NULL value).

IS NOT

Returns all records whose specified value is not NULL (contains the NULL value).

AND

The AND operator returns values when both conditions are true.

OR

The OR operator returns values when one of the conditions is true.

<=>

Used with parameters of the Object type.

Build a single query that specifies all desired sub-parameter matches that are contained within the main object parameter.

~>

Returns any object with any field that matches the specified string.

Data categories

In Expert mode, queries are used to refine one of three data groups:

  • Assets
  • Vulnerabilities
  • Findings

As a result, all query parameters are either asset-based, vulnerability-based, or finding-based. One or more of these parameter groups may be available, depending on the type of filter being applied.

Advanced query logic

In some scenarios, it is more useful to create a query based on is not desired. Using advanced query logic can accomplish this.

For example, if the universe is food and a type is fruit the following query will surface all foods except fruits that are apples.

!(food.fruit = apples)

We set the entire query to false.

Another example is wanting to query for all fruits except apples. This is accomplished by setting the value of the query to false.

food.fruit != apples

Joining two indexes of different types

You can combine two indexes of two different types.

asset.software.vendor = 'Rapid7`' AND asset.software.version = 'foo'

In this example, the queries return a set containing all assets with Rapid7 products and any assets with a product of version 'foo' (Rapid7 or not).