Asset Filters

Note: This section describes the filters in the legacy user interface (Explore > Asset Inventory (Legacy)).

You can add filters to your inventory to view assets by their importance. Each asset has 130+ properties that can be filtered using one or more filters.

You can filter your assets in two ways:

  • Legacy Filtering — Allows you to select from available filters to match assets.

  • Robust Filtering — Allows you to filter by matching column names using strings with AND/OR operators. You can also use two levels of nesting.

To filter your assets:

  1. At the top of the table, click Add Filter.

    The Add Filter drop-down appears.

  2. Use the Search for Filters box or select the filter from the list. For example, Name.

    The list of operators appears.

  3. Select the operator. For example, contains.

  4. Type the value of the filter, if needed.

  5. Click Done.

  6. (Optional) To add another filter, click Add Filter.

    1. Repeat steps from 2 to 5.

      Tenable Attack Surface Management adds a new third filter to the list with the following options:

      • that match all filters —  Lists only the assets that match all the filters.

      • that match any filters — Lists assets that match any one of the filters.

    2. Select one of the options and click Done.

      Tenable Attack Surface Management shows the filtered results.

Examples

  • Filter assets that have a TLS certificate that ages out within 3 days.

    1. Click Add Filter.

      A drop-down menu appears.

    2. Select the SSL/TLS Expiration filter.

    3. In the expires in box, type 3.

    4. Click Done.

      Tenable Attack Surface Management limits your list of assets to only those that have an SSL/TLS certificate aging out within 3 days.

When applying a filter, a column corresponding to the filter is also included in the results. In this case, because the SSL/TLS Expiration filter is used, Tenable Attack Surface Management adds an SSL/TLS Expiration column.

Using Multiple Filters

Multiple filters can be used at the same time to add incredible granularity. When using multiple filters, you have an option of matching "all" or "any" filters.

The following are examples of using multiple filters:

  • Assets not hosted in the United States

  • Assets not hosted in the USA that sets cookies

  • Assets not hosted in the USA that sets cookies, whose registrar email address contains the word "hostmaster, and has port 3306 open.

To filter your assets using Robust filtering:

  1. At the top of the table, click Robust Filtering.

    The Robust filtering box appears.

  2. Click inside the box.

    A drop-down appears with the list of Column names.

    Tip: You can use the arrow keys to navigate the filter drop-down box and press the Enter key to select an option.

  3. Filter the assets:

    Note: A single query can have only a maximum of 15 filters.

    1. Type the column name or select the column name from the list of matching suggestions.

    2. Select or type the filter type.

    3. Filter Type Description
      contains Filters for items that contain the filter value.
      does not contain Filters for items that do not contain the filter value.
      ends with Filters for items that end with the filter values.
      expired less than Filters for items that aged out within a specific number of days. This value requires an input for the number of days. For example, SSL / TLS Expiration.
      expired more than Filters for items that aged out more than a specific number of days. This value requires an input for the number of days. For example, SSL / TLS Expiration.
      expires after Filters for items that age out after a specific date. The value requires a date input. For example, SSL / TLS Expiration.
      expires before Filters for items that age out before a specific date. The value requires a date input. For example, SSL / TLS Expiration.
      expires in Filters for items that age out within a specific number of days. This value requires an input for the number of days. For example, SSL / TLS Expiration.
      expires on Filters for items that age out on a specific date. The value requires a date input. For example, SSL / TLS Expiration.
      has any value Filters for items that have any associated value.
      is Filters for items that match the selected filter value.
      is expired Filters for items that have aged out. For example, SSL / TLS Expiration.
      is not Filters for items that do not match the filter value.
      is not expired Filters for items that have not aged out. For example, SSL / TLS Expiration.
      is not one of Filters for items that do not match any of the filter values.
      Note: The filter values must be separated by commas without any spaces. For example, Host is-not-one-of x,y,z.
      is one of

      Filters for items that match one of the filter values.

      Note: The filter values must be separated by commas without any spaces. For example, Host is-one-of x,y,z.
      is unknown Filters for items that have unknown value.
      not scanned Filters for items that are not scanned.
      scanned Filters for items that are scanned.
      starts with Filters for items that start with the filter values.
      yes Filters for items that match the "Yes" input. For example, Cloud Hosted.
      no Filters for items that match the "No" input. For example, Cloud Hosted.
      greater than Filters for items that match a value greater than the specified number.
      less than Filters for items that match a value less than the specified number.

    4. Provide the values for the selected type.

      Note: For special filters such as tags and dates, the filter displays the relevant menu to select the values.

      • Tag filter — Displays a drop-down with the list of available tags.

      • Date filter — Displays a date picker where you can input the date.

    5. Type the End label, if prompted.

    6. For multiple querying, type AND or OR operators in the box and select one of the operators.

      Note: AND and OR operators are not allowed on the same level.
      Note: If you want to filter on a value that has quotation marks (") or spaces, then you must wrap the value in quotation marks (").
      If there are quotation marks within the value, then you must use the escape character (\) for the quotation marks ("). For example, to filter the value <div id=“filter_value”, do this: “<div id=\“filter_value\“”

    7. (Optional) Use parentheses to add nested filters.

      Note: Filters can have a maximum of two nesting levels.

  4. (Optional) To add or remove filters, do one of the following:

    • To add multiple filters, press Space and then select another condition, operator, filter, and value.

    • To clear the filters, click the button in the right corner of the text box.

  5. Click Apply.

    Tenable Attack Surface Management filters your data.

  6. (Optional) Save the filters to access later or share.

Filter 1: Host contains example.com

Where:

  • Host is the column.

  • contains is the filter type.

  • example.com is the value.

Filter 2: SSL / TLS Valid From less-than 3 days ago

Where:

  • SSL / TLS Valid From is the column name.

  • less-than is the filter type.

  • 3 is the value.

  • days ago is the end label. This is not optional and Tenable Attack Surface Management prompts you to type the text when the filter requires it.

If you are using Legacy filtering to filter your assets, you can change your filtering method to Robust filtering by clicking Robust Filtering. This converts your selected filters to the Robust filtering mode. You can also convert your saved filters to Robust filtering.

Note: You cannot convert the filtering method from Robust filtering to Legacy filtering.

When adding an asset filter from the asset inventory page, selecting the Tag filter provides these options: is and is not - filtering for assets that do have a particular tag or do not have a particular tag, respectively. Choosing an operator displays a drop-down list of tags to filter on.

However, not all tags are available to select in this list. The following are the conditions based on which the tags are listed in the tag filter drop-down list.

  • Tags with a specific custom value type are not listed.

  • Only tags with the I don't want to assign values with this Tag value are listed.

  • Tags with the value type, such as Keyword, Date, or Boolean, are listed as individual filters in the list of filters in the Generic section in the Manage Columns page.

Tenable Attack Surface Management uses filters to provide powerful inventory search capabilities. Filters allow you to view specific subsets of assets in your inventory.

To apply a filter:

  1. Click inside the Enter a filter query box to display the list of available filters.

  2. Type or select a filter you want to use.

    A list of operators appears. This list varies based on the filter you select.

  3. If the operator requires a value, type that value in the text box.

  4. Add AND or OR conditions as needed.

  5. Press Enter to apply the query.

    Your inventory displays only assets matching the filter criteria.

    In this example, your inventory displays only assets with a TLS certificate that expires within the next 30 days. The SSL/TLS Expiration column also appears.