Custom Queries

The global search includes three types of custom searches you can perform to filter your inventory.

To access the query builder:

In the Assetsor Findings view, on the right side of the search bar, click the button.

The custom queries drop-down appears.

Select one of the following options:

Query

The Query option allows you to build structured searches using query using blocks of property filters and criteria.

Tip: For a full list of possible operators, selectors, properties, and workflows, see Query Operators, Properties, and Selectors.

Start a query

Syntax: AS [object_type] [criteria]

Start by choosing what you want to find. For example, a device:

Click inside the query box to specify AS, the selector that filters and queries objects based on their type.
Select “Device” and press Enter.

The query returns all devices in the inventory.

You can also select other options such as infrastructure as code, accounts, or people.

Examples:

AS device: Returns all devices in the system
AS account: Returns all accounts in the system
AS account device: Returns all accounts and devices

Add Details (Property Filters) to your Query

Property filters enhance the query to include details about your object type.

Syntax: AS [object_type] HAS [property]:[value]

After you select your object type (e.g. devices), choose the selector HAS in the query box.

The selector HAS marks the beginning of a filtering block, allowing you to specify criteria for selecting a subset from the larger inventory, combining multiple filters, and customizing attributes.
Select a property filter for the object. For example: “Internet-facing”.
Press Enter.

The query returns all devices that are internet-facing in the inventory.
Add another property filter using the AND or OR operator. For example, “Last Update Date”.
Press Enter.

The search returns all internet-facing devices last updated on the specified date in the inventory.
You can add as many property filters as needed to the query.

Specify Relationships in your Query

In addition to property filters, you can find relationships with other criteria using the WITH selector for more refined and precise results through multiple conditions, nested queries, and customization beyond basic conditions.

For example, you want to search for a specific weakness type in an object:

In the query box, choose the WITH selector and select “Weakness”.
Press Enter. The query returns all internet-facing devices last updated on the specified date that contain weaknesses in the inventory.
You can also add property filters to the query. For example, a “Weakness ID” type.
You can also add other relationships with the WITH selector: Software or Entitlement.

The query takes into account the property filters related to the last used object type.

Custom Query Examples

AS device HAS weakness:severity:"High" - Finds devices with high-severity vulnerabilities

AS account HAS entitlement:name:"Admin Access" AND software:name:"Microsoft Office" - Finds accounts with admin access and Microsoft Office installed

For a full list of possible operators, selectors, properties, and workflows, see Query Operators, Properties, and Selectors.

NLP

You can use Natural Language Processing (NLP) to ask questions about your objects and receive AI-generated answers.

In the Ask anything text box, type a question you want to ask about your objects. For example, you could ask "How many critical assets do I have?".

This response only includes information related to your query. If no data is available, an error message appears indicating no data could be generated for the search criteria you entered.

Tip: For more information on NLP and its use cases, see NLP Search Use Cases in the Tenable Exposure Management User Guide.

Simple

A Simple search allows you to filter your objects by name or ID.

In the search text box, type the name or ID by which you want to filter the list. Tenable Exposure Management performs the search and filters the list based on your query.