...
"sortField" : <string> OPTIONAL (alphanumeric; any valid field returned in the results entry for the corresponding tool. [Some restrictions apply.] Must accompany sortDir),
"sortDir" : <string> "ASC" | "DESC" DEFAULT "ASC" (default "ASC" if not specified and sortField is specified),
"startOffset" : <number> OPTIONAL (integer; lower bound to returned record set. Must be explicitly supplied for tools "vulndetails" and "listvuln"),
"endOffset" : <number> OPTIONAL (integer; upper bound to returned record set. Must be explicitly supplied for tools "vulndetails" and "listvuln"),
"tool" : <string> "iplist" | "listmailclients" | "listos" | "listservices" | "listsoftware" | "listsshservers" | "listvuln" | "listwebclients" | "listwebservers" | "remediationdetail" | "sumasset" | "sumcce" | "sumclassa" | "sumclassb" | "sumclassc" | "sumcve" | "sumdnsname" | "sumfamily" | "sumiavm" | "sumid" | "sumip" | "summsbulletin" | "sumport" | "sumprotocol" | "sumremediation" | "sumseverity" | "sumuserresponsibility" | "vulndetails" | "vulnipdetail" | "vulnipsummary",
"filters" : [
{
"filterName" : <string> "acceptRiskStatus" | "asset" | "assetCriticalityRating" | "assetID" | "auditFile" | "auditFileID" | "baseCVSSScore" | "benchmarkName" | "cceID" | "cpe" | "cveID" | "cvssV3BaseScore" | "cvssV3Vector" | "cvssVector" | "dataFormat" | "daysMitigated" | "daysToMitigated" | "dnsName" | "exploitAvailable" | "exploitFrameworks" | "family" | "familyID" | "firstSeen" | "iavmID" | "ip" | "lastMitigated" | "lastSeen" | "mitigatedStatus" | "msbulletinID" | "outputAssets" | "patchPublished" | "pluginID" | "pluginModified" | "pluginName" | "pluginPublished" | "pluginText" | "pluginType" | "policy" | "policyID" | "port" | "protocol" | "recastRiskStatus" | "repository" | "repositoryIDs" | "responsibleUser" | "responsibleUserIDs" | "severity" | "solutionID" | "stigSeverity" | "tcpport" | "udpport" | "uuid" | "vprScore" | "vulnPublished" | "xref",
filterName "acceptRiskStatus" -----------------------------
"operator" : <string> "=",
"value" : <string> "all" | "accepted" | "notAccepted"
NOTE: During evaluation on the Analysis page, or for various objects, presenting
no "acceptRiskStatus" filter defaults to the "notAccepted" behavior.
filterName "asset" ------------------
"operator": <string> "=" | "~" (combination expression),
filterName "asset", operator "=" --------------------------------
"value" : [
{
"id" : <number> (integer)
}...
]
filterName "asset", operator "~" --------------------------------
"value" : <comboRecord> {
"operator": <string> "complement" | "intersection" | "difference" | "union",
"operand1": <comboRecord> | <number> (integer) | {
"id" : <number> (integer)
}
operator not "complement" -------------------------
"operand2": <comboRecord> | <number> (integer) | {
"id" : <number> (integer)
}
}
filterName "assetCriticalityRating" --------------------------
"operator" : <string> "=",
"value" : <string> (inclusive, nonnegative, decimal range, using a dash ["-"] delimiter)
filterName "auditFile" | "policy" | "repository" | "responsibleUser" --------------------------------------------------------------------
"operator": <string> "=",
"value" : {
"id" : <number> (integer)
}
filterName "baseCVSSScore" --------------------------
"operator" : <string> "=",
"value" : <string> (inclusive, nonnegative, decimal range, using a dash ["-"] delimiter)
filterName "benchmarkName" --------------------------
"operator" : <string> "=" (fuzzy-left, right-anchored match),
"value" : <string>
filterName "cceID" | "iavmID" -----------------------------
"operator" : <string> "=" (fuzzy match),
"value" : <string> (comma-separated list)
filterName "cpe" ----------------
"operator": <string> "=" (i.e. explicit per entry) |
"~=" (i.e. fuzzy match across entire entries string) |
"pcre" (i.e. Perl-compatible, regular expression, across entire entries string),
filterName "cpe", operator "=" | "~=" -------------------------------------
"value" : <string> (comma-separated or newline-separated list)
filterName "cpe", operator "pcre" ---------------------------------
"value" : <string> (Perl-compatible, regular expression)
filterName "cveID" | "msbulletinID" -----------------------------------
"operator" : <string> "=" (fuzzy match),
"value" : <string> (comma-separated or newline-separated list)
filterName "cvssVector" -----------------------
"operator" : <string> "=",
"value" : <string> (comma-separated list of Simple or Complex CVSS vectors)
Simple CVSS Vector = <string> "AV:L" | "AV:A" | "AV:N" | "AC:H" | "AC:M" | "AC:L" | "Au:N" | "Au:S" | "Au:M" | "C:N" | "C:P" | "C:C" | "I:N" | "I:P" | "I:C" | "A:N" | "A:P" | "A:C" | "E:ND" | "E:U" | "E:P" | "E:POC" | "E:F" | "E:H" | "RL:ND" | "RL:O" | "RL:OF" | "RL:T" | "RL:TF" | "RL:W" | "RL:U" | "RC:ND" | "RC:UC" | "RC:UR" | "RC:C" Complex CVSS Vector = <string> (slash-separated list of Simple CVSS Vectors where all entries must match)
filterName "cvssV3BaseScore" --------------------------
"operator" : <string> "=",
"value" : <string> (inclusive, nonnegative, decimal range, using a dash ["-"] delimiter)
filterName "cvssV3Vector" -----------------------
"operator" : <string> "=",
"value" : <string> (comma-separated list of Simple or Complex CVSS vectors)
Simple CVSS Vector = <string> "AV:P" | "AV:L" | "AV:A" | "AV:N" | "AC:H" | "AC:L" | "PR:H" | "PR:L" | "PR:N" | "PR:U" | "UI:R" | "UI:N" | "S:C" | "S:U" | "C:N" | "C:L" | "C:H" | "I:N" | "I:L" | "I:H" | "A:N" | "A:L" | "A:H" | "E:H" | "E:F" | "E:P" | "E:U" | "E:X" | "RL:U" | "RL:W" | "RL:OF" | "RL:T" | "RL:O" | "RL:X" | "RC:C" | "RC:R" | "RC:U" | "RC:X" Complex CVSS Vector = <string> (slash-separated list of Simple CVSS Vectors where all entries must match)
filterName "daysMitigated" | "firstSeen" | "lastMitigated" | "lastSeen" | "pluginModified" | "pluginPublished" | "vulnPublished" ---------------------------------------------------------------------------------------------------------------------------------------------------
"operator": <string> "=" (relative with custom format),
"value" : <string> "<minDaysBack>:<maxDaysBack>" (Both minDaysBack and maxDaysBack are provided in the number of days ago. [e.g. "0:90" is between now and 90 days ago].) | "<minDaysBack>:all" (A value "all" indicates to return all results before minDaysBack) | "currentMonth" | "lastMonth" | "currentQuarter" (i.e. the current fiscal quarter) | "lastQuarter" filterName "dnsName" --------------------
"operator" : <string> "=",
"value" : <string> (comma-separated or newline-separated list of valid DNS names)
filterName "exploitAvailable" -----------------------------
"operator" : <string> "=",
"value" : <string> "true" | "false" filterName "exploitFrameworks" ------------------------------
"operator": <string> "=" (i.e. explicit for entire entries string) |
"~=" (i.e. fuzzy match across entire entries string),
"value" : <string> filterName "family" -------------------
"operator": <string> "=" | "!=",
"value" : [
{
"id" : <number> (integer)
}...
]
filterName "ip" ---------------
"operator" : <string> "=" | "!=",
"value" : <string> (comma-separated or newline-separated list of valid IPs and/or DNS names)
filterName "mitigatedStatus" ----------------------------
"operator": <string> "=",
"value" : <string> "previously" | "never"
filterName "outputAssets" -------------------------
"operator": <string> "=",
"value" : <string> (comma-separated list of Integers) | [
{
"id" : <number> (integer)
}...
]
filterName "patchPublished" ---------------------------
"operator": <string> "=",
"value" : <string> "<endDay>:<startDay>" | "<endDay>:all" (Both endDay and startDay are provided in the number of days ago. [e.g. "0:90" is between now and 90 days ago]. A value of "all" for startDay is interpreted as "0" [i.e. from "now", back endDay days ago]) | "currentMonth" | "lastMonth" | "currentQuarter" (i.e. the current fiscal quarter) | "lastQuarter" | "none" (i.e vulnerabilities that cannot be resolved through a patch)
filterName "pluginID" ---------------------
"operator" : <string> "=" | "!=" | "<=" | ">=",
filterName "pluginID", operator "=" | "!=" ------------------------------------------
"value" : <number> (comma-separated or newline-separated list of integers or inclusive integer ranges, using a dash ["-"] delimiter, with each value between 0 and 8388607)
filterName "pluginID", operator "<=" | ">=" -------------------------------------------
"value" : <number> (integer, between 0 and 8388607)
filterName "pluginName" -----------------------
"operator": <string> "=" (i.e. fuzzy match) | "pcre" (i.e. Perl-compatible, regular expression),
"value" : <string> filterName "pluginText" -----------------------
"operator": <string> "=" (i.e. fuzzy match, stripped text [forced]) |
"pcre" (i.e. Perl-compatible, regular expression, stripped text [forced]),
"value" : <string> filterName "pluginType" -----------------------
"operator": <string> "=",
"value" : <string> "passive" | "lce" | "active" | "compliance" (comma-separated)
filterName "port" | "tcpport" | "udpport" -----------------------------------------
"operator" : <string> "=" | "!=" | "<=" | ">=",
filterName "port" | "tcpport" | "udpport", operator "=" | "!=" --------------------------------------------------------------
"value" : <number> (comma-separated or newline-separated list of integers or inclusive integer ranges, using a dash ["-"] delimiter, with each value between 0 and 65535)
filterName "port" | "tcpport" | "udpport", operator "<=" | ">=" ---------------------------------------------------------------
"value" : <number> (integer, between 0 and 65535)
filterName "protocol" ---------------------
"operator": <string> "=" | "!=",
"value" : <string> (comma-separated or newline-separated list of integers)
filterName "recastRiskStatus" -----------------------------
"operator" : <string> "=",
"value" : <string> "recast" | "notRecast" filterName "severity" ---------------------
"operator": <string> "=" | "!=",
"value" : <string> (comma-separated or newline-separated list of integers) | [
{
"id" : <number> (integer)
}...
]
filterName "solutionID" ---------------------
"operator" : <string> "=" "value" : <string> "SC-" + <number> (comma-separated or newline-separated list of integers; number is an integer representing the Plugin ID of a solution)
filterName "stigSeverity" -------------------------
"operator": <string> "=" | "!=",
"value" : <string> (comma-separated or newline-separated list of Roman Numerals) | [
{
"id" : <string> (valid Roman Numeral)
}...
]
filterName "vprScore" --------------------------
"operator" : <string> "=",
"value" : <string> (inclusive, nonnegative, decimal range, using a dash ["-"] delimiter)
filterName "xref" -----------------
"operator" : <string> "=" | "!=",
"value" : <string> (comma-separated list of XREF Expressions)
XREF Expression = <string> "<type>|<wildCard>" (XREF Type and ID Wildcard, pipe-delimited)
XREF Type = <string> ID Wildcard = <string> (where "?" matches a single occurrence of any character and "*" matches any character, any number of times)
}...
] DEFAULT []
...
