Query Builder Filters
On the Vulnerability Intelligence page and the Vulnerability Profile page, use the Query Builder to refine your results. Show only the CVEs, findings, or affected assets you want to take action on.
The following table lists the filters you can use with the Query Builder and the tabs they appear in.
| Filter | Description | Appears In... |
|---|---|---|
| ACR |
Filter by Tenable-defined Asset Criticality Rating (ACR) as a number from 1 to 10. |
My Findings, My Affected Assets |
| AES |
Filter by Tenable-defined Asset Exposure Score (AES) as a number from 0 to 1000. |
My Findings, My Affected Assets |
| Asset ID | Filter by the UUID of the asset. This value is unique to Tenable Security Center. | My Findings, My Affected Assets |
| Asset Name | Filter by asset name, for example the IPv4 address 206.206.136.40. | My Findings, My Affected Assets |
| Category | Filter by category, as described in Vulnerability Categories. | CVEs, My Findings, My Affected Assets |
| CVE ID | Filter by Common Vulnerabilities and Exposures (CVE) ID, for example CVE-2002-2024. | CVEs |
| CVSSv2 Score | Filter by the CVSSv2 score for the vulnerability, for example 5.2. When not available from NVD, Tenable determines this score. To learn more, see CVSS vs. VPR. | CVEs |
| CVSSv3 Attack Complexity | Filter by attack complexity, which defines how difficult it is to use a vulnerability in an attack. Choose from High or Low. | CVEs |
| CVSSv3 Attack Vector | Filter by attack vector, which defines an attack's location. Choose from Adjacent, Network, Local, or Physical. | CVEs |
| CVSSv3 Availability | Filter by the affected asset's availability. Choose from High, Low, or None. For example, an affected asset with High is completely unavailable. | CVEs |
| CVSSv3 Score | Filter by the CVSSv3 score for the vulnerability, for example 4.3. When not available from NVD, Tenable determines this score. To learn more, see CVSS vs. VPR. | CVEs, My Findings, My Affected Assets |
| CVSSv3 Confidentiality |
Filter by the expected impact of the affected asset's information confidentiality loss. Choose from High, Low, or None. For example, an affected asset with High may have a catastrophic adverse effect on your organization or customers. |
CVEs |
| CVSSv3 Integrity | Filter by the expected impact of the affected asset's data integrity loss. Choose from High, Low, or None. | CVEs |
| CVSSv3 Privileges Required | Filter by the permission level attackers require to exploit the vulnerability. Choose from High, Low, or None. None means attackers need no permissions in your environment and can exploit the vulnerability while unauthorized. | CVEs |
| CVSSv3 Scope |
Filter by whether a vulnerability allows attackers to compromise resources beyond an affected asset's normal authorization privileges. Choose from Unchanged or Changed. Changed means the vulnerability increases the affected asset's privileges. |
CVEs |
| CVSSv3 User Interaction |
Filter by whether a vulnerability requires other users (such as end users) for attackers to be able to use it. Choose from Required or None. None is more severe since it means that no additional user interaction is required. |
CVEs |
| CVSSv4 Score | Filter by the CVSSv4 score for the vulnerability, for example, 4.3. When not available from NVD, Tenable determines this score. To learn more, see CVSS vs. VPR. | CVEs, My Findings, My Affected Assets |
| EPSS Score |
Filter by the percentage likelihood that a vulnerability will be exploited, based on the third-party Exploit Prediction Scoring System (EPSS). Type a number from 1 to 100 with up to three decimal places, for example, 50.5. |
CVEs |
| Exploit Maturity | Filter by exploit maturity based on sophistication and availability. This information is drawn from Tenable’s own research as well as key external sources. Choose from High, Functional, PoC, or Unproven. | CVEs |
| First Discovered | Filter for the date a vulnerability was first identified. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others. | CVEs |
| First Functional Exploit |
Filter for the date a vulnerability was first known to be exploited. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others. |
CVEs |
| First Proof of Concept | Filter for the date a vulnerability's first proof of concept was found. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others. | CVEs |
| IP Address |
Filter for affected asset IPv4 and IPv6 addresses as a single IP, an IP range, or an IP Classless Inter-Domain Routing (CIDR) block. For example, type 172.16.2.1-172.16.2.100, ::ffff:c0a8:102. |
My Findings, My Affected Assets |
| Last Seen | Filter for the date a finding affected or asset last appeared on a scan. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others. | My Findings, My Affected Assets |
| Operating System | Filter by assets running the specified operating system. | My Findings, My Affected Assets |
| Plugins Available | Filter by whether or not a vulnerability currently has a Tenable plugin that detects it. Choose from Yes or No. | CVEs |
|
Plugin Family |
Filter by the family of the Tenable plugin that detected the vulnerability. For example, Service detection. |
My Findings, My Affected Assets, Plugins |
| Plugin ID | Filter by the ID of the Tenable plugin that detected the vulnerability, for example 157288. To look up plugin IDs, go to the Tenable website. | CVEs, My Findings, My Affected Assets, Plugins |
| Plugin Name | Filter by the name of the Tenable plugin that detected the vulnerability, for example TLS Version 1.1 Protocol Deprecated. | My Findings, My Affected Assets, Plugins |
|
Plugin Type |
Filter by the type of Tenable plugin that detected the vulnerability. For example, remote. |
My Findings, My Affected Assets, Plugins |
| Repository | Filter for assets with associated vulnerability data in the specified repository. | My Findings, My Affected Assets |
|
Severity |
Filters by the vulnerability's CVSS-based severity. To learn more, see CVSS vs. VPR. |
My Findings, My Affected Assets, Plugins |
| VPR |
Filter by the Tenable-calculated Vulnerability Priority Rating (VPR) score, as a number from 1 to 10. Note: A finding's VPR is based on the VPR of the plugin that identified it. When plugins are associated with multiple vulnerabilities, the highest VPR appears.
|
CVEs, My Findings, My Affected Assets |
| VPR Threat Intensity | Filter for a vulnerability's Tenable-calculated threat intensity based on the number and frequency of threat events. Choose from Very Low, Low, Medium, High, or Very High. | CVEs |