Findings Export Fields and Associated CSV Keys
On the Export Findings page you can export data from the Findings page in either CSV or JSON format. When you export a CSV file, it contains keys and their corresponding values. However, some of the keys used in the CSV may not clearly match the export fields selected for each Finding Type. The following tables provide a reference that maps the export fields to their corresponding CSV keys for each Finding Type.
Vulnerabilities Findings Export Mapping
The following table shows the mapping of each Vulnerabilities Findings Export Field to the associated key in the exported CSV file.
| Vulnerabilities Findings Export Fields | Vulnerabilities Findings Export CSV Keys |
|---|---|
| Age | age_in_days |
| FQDN | asset.display_fqdn |
| IPv4 Address | asset.display_ipv4_address |
| IPv4 Addresses | asset.ipv4_addresses |
| IPv6 Address | asset.display_ipv6_address |
| IPv6 Addresses | asset.ipv6_addresses |
| Last Authenticated Scan | asset.last_authenticated_scan_time |
| Last Licensed Scan | asset.last_licensed_scan_time |
| MAC Address | asset.display_mac_address |
| Host | asset.host_name |
| Asset ID | asset.id |
| Asset Name | asset.name |
| NetBIOS Name | asset.netbios_name |
| Type | asset.network.id |
| Network | asset.network.name |
| Operating System | asset.operating_system |
| Operating Systems | asset.operating_systems |
| System Type | asset.system_type |
| Tags | asset.tags |
| Asset Inventory | asset_inventory |
| Default/Known Account | default_account |
| Bugtraq ID | definition.bugtraq |
| CPE | definition.cpe |
| CVE | definition.cve |
| CVSSv2 Base Score | definition.cvss2.base_score |
| CVSSv2 Vector | definition.cvss2.base_vector |
| CVSSv2 Temporal Score | definition.cvss2.temporal_score |
| CVSSv2 Temporal Vector | definition.cvss2.temporal_vector |
| CVSSv3 Base Score | definition.cvss3.base_score |
| CVSSv3 Vector | definition.cvss3.base_vector |
| CVSSv3 Temporal Score | definition.cvss3.temporal_score |
| CVSSv3 Temporal Vector | definition.cvss3.temporal_vector |
| CVSSv4 Base Score | definition.cvss4.base_score |
| CVSSv4 Vector | definition.cvss4.base_vector |
| CWE | definition.cwe |
| Plugin Description | definition.description |
| EPSS | definition.epss.score |
| Exploitability Ease | definition.exploitability_ease |
| Exploited By Malware | definition.exploited_by_malware |
| Exploited By Nessus | definition.exploited_by_nessus |
| Plugin Family | definition.family |
| Finding ID | id |
| IAVA ID | definition.iava |
| IAVB ID | definition.iavb |
| IAVM Severity | definition.iavm |
| IAVT ID | definition.iavt |
| Plugin ID | definition.id |
| In The News | definition.in_the_news |
| Malware | definition.malware |
| Plugin Name | definition.name |
| Patch Published | definition.patch_published |
| Plugin Published | definition.plugin_published |
| Plugin Updated | definition.plugin_updated |
| Plugin Version | definition.plugin_version |
| Reference Information | definition.references |
| See Also | definition.see_also |
| Original Severity | definition.severity |
| Solution | definition.solution |
| Stig Severity | definition.stig_severity |
| Synopsis | definition.synopsis |
| Plugin Type | definition.type |
| Unsupported By Vendor | definition.unsupported_by_vendor |
| Exploit Code Maturity | definition.vpr.drivers_exploit_code_maturity |
| VPR | definition.vpr.score |
| VPR Key Driver CVE ID | definition.vpr.drivers_cve_id |
| VPR Key Driver Exploit Chain | definition.vpr.drivers_exploit_chain |
| VPR Key Driver Exploit Probability | definition.vpr.drivers_exploit_probability |
| VPR Key Driver In the News Intensity, last 30 days | definition.vpr.drivers_in_the_news_intensity_last_30 |
| VPR Key Driver In the News Recency | definition.vpr.drivers_in_the_news_recency |
| VPR Key Driver In the News Sources, last 30 days | definition.vpr.drivers_in_the_news_sources_last_30 |
| VPR Key Driver Malware Observations Intensity, last 30 days | definition.vpr.drivers_malware_observations_intensity_last_30 |
| VPR Key Driver Malware Observations Recency | definition.vpr.drivers_malware_observations_recency |
| VPR Key Driver On CISA KEV | definition.vpr.drivers_on_cisa_kev |
| VPR Key Driver Targeted Industries | definition.vpr.drivers_targeted_industries |
| VPR Key Driver Targeted Regions | definition.vpr.drivers_targeted_regions |
| VPR Key Driver VPR Percentile | definition.vpr.drivers_vpr_percentile |
| VPR Key Driver VPR Severity | definition.vpr.drivers_vpr_severity |
| Vulnerability Published | definition.vulnerability_published |
| Workaround | definition.workaround |
| Workaround Published | definition.workaround_published |
| Workaround Type | definition.workaround_type |
| First Seen | first_observed |
| Last Fixed | last_fixed |
| Last Seen | last_seen |
| Plugin Output | output |
| Port | port |
| Protocol | protocol |
| Recast Reason | recast_reason |
| Resurfaced Date | resurfaced_date |
| Risk Modified | risk_modified |
| Scan ID | scan.id |
| Last Scan Target | scan.target |
| Severity | severity |
| Software Information | software_vulns |
| Source | source |
| State | state |
| Time Taken to Fix | time_to_fix |
| Vulnerability Age | vuln_age |
| Vuln SLA Date | vuln_sla_date |
Use this link to download the CSV file for the Vulnerabilities Findings Export Mappings.
Web Application Findings Export Mapping
The following table shows the mapping of each Web Application Finding Export Field to the associated key in the exported CSV file.
| Web App Findings Export Fields in UI | Web App Findings Export CSV Keys |
|---|---|
| Age | age_in_days |
| Asset ID | asset_id |
| Asset ID | asset.id |
| Asset Name | asset.name |
| CVSSv2 Base Score | definition.cvss2.base_score |
| CVSSv2 Vector | definition.cvss2.base_vector |
| CVSSv3 Base Score | definition.cvss3.base_score |
| CVSSv3 Vector | definition.cvss3.base_vector |
| CVSSv4 Base Score | definition.cvss4.base_score |
| CVSSv4 Vector | definition.cvss4.base_vector |
| Finding ID | finding_id |
| First Seen | first_observed |
| FQDN | asset.display_fqdn |
| Host | asset.host_name |
| IPv4 Address | asset.ipv4_addresses |
| Last Fixed | last_fixed |
| Last Licensed Scan | asset.last_licensed_scan_time |
| Last Seen | last_seen |
| MAC Address | asset.display_mac_address |
| Operating System | asset.operating_system |
| Original Severity | definition.severity |
| Plugin Description | definition.description |
| Plugin Family | definition.family |
| Plugin ID | definition.id |
| Plugin Updated | definition.plugin_updated |
| Plugin Name | definition.name |
| Plugin Output | output |
| Plugin Published | definition.plugin_published |
| Reference Information | definition.references |
| Resurfaced Date | resurfaced_date |
| Risk Modified | risk_modified |
| See Also | definition.see_also |
| Severity | severity |
| Solution | definition.solution |
| State | state |
| System Type | asset.system_type |
| Tags | asset.tags |
| URL | url |
| VPR | definition.vpr.score |
| VPR Key Driver CVE ID | definition.vpr.drivers_cve_id |
| VPR Key Driver Exploit Chain | definition.vpr.drivers_exploit_chain |
| VPR Key Driver Exploit Code Maturity | definition.vpr.drivers_exploit_code_maturity |
| VPR Key Driver Exploit Probability | definition.vpr.drivers_exploit_probability |
| VPR Key Driver In the News Intensity, last 30 days | definition.vpr.drivers_in_the_news_intensity_last_30 |
| VPR Key Driver In the News Recency | definition.vpr.drivers_in_the_news_recency |
| VPR Key Driver In the News Sources, last 30 days | definition.vpr.drivers_in_the_news_sources_last_30 |
| VPR Key Driver Malware Observations Intensity, last 30 days | definition.vpr.drivers_malware_observations_intensity_last_30 |
| VPR Key Driver Malware Observations Recency | definition.vpr.drivers_malware_observations_recency |
| VPR Key Driver On CISA KEV | definition.vpr.drivers_on_cisa_kev |
| VPR Key Driver Targeted Industries | definition.vpr.drivers_targeted_industries |
| VPR Key Driver Targeted Regions | definition.vpr.drivers_targeted_regions |
| VPR Key Driver VPR Percentile | definition.vpr.drivers_vpr_percentile |
| VPR Key Driver VPR Severity | definition.vpr.drivers_vpr_severity |
| Vuln SLA Date | vuln_sla_date |
Use this link to download the CSV file for the Web Application Findings Export Mappings.
External Attack Surface Findings Export Mapping
The following table shows the mapping of each External Attack Surface Findings Export Field to the associated key in the exported CSV file.
| External Attack Surface Findings Export Fields | External Attack Surface Findings Export CSV Keys |
|---|---|
| Administrative Contact Email | whois_data_administrative_contact_email |
| Administrative Contact Name | whois_data_administrative_contact_name |
| Administrative Contact Organization | whois_data_administrative_contact_organization |
| Administrative Contact Telephone | whois_data_administrative_contact_telephone |
| Asset ID | asset.id |
| Asset Name | asset.name |
| Billing Contact Email | whois_data_billing_contact_email |
| Canonical URL | http_metadata_canonical |
| Contact Email | whois_data_contact_email |
| Content Language | http_metadata_content_language |
| Content Length | http_metadata_content_length |
| Domain Name Expiration | whois_data_expires_date |
| Final Response Code | http_metadata_final_response_code |
| Final URL | http_metadata_final_url |
| Finding ID | id |
| HTTP Content Type | http_metadata_content_type |
| HTTP Headers | http_metadata_headers |
| HTTP Server | http_metadata_server |
| Last Seen | last_found |
| Password Fields Count | http_metadata_password_fields_count |
| Redirect Chain | http_metadata_redirect_chain |
| Registrant City | whois_data_registrant_city |
| Registrant Country | whois_data_registrant_country |
| Registrant Email | whois_data_registrant_email |
| Registrant Fax | whois_data_registrant_fax |
| Registrant Name | whois_data_registrant_name |
| Registrant Organization | whois_data_registrant_organization |
| Registrant Postal Code | whois_data_registrant_postal_code |
| Registrant State | whois_data_registrant_state |
| Registrant Street 1 | whois_data_registrant_street1 |
| Registrant Street 2 | whois_data_registrant_street2 |
| Registrant Street 3 | whois_data_registrant_street3 |
| Registrant Street 4 | whois_data_registrant_street4 |
| Registrant Telephone | whois_data_registrant_telephone |
| Registrar Name | whois_data_registrar_name |
| Response Code | http_metadata_response_code |
| Screenshot | http_metadata_screenshot |
| Security Headers | http_metadata_security_headers |
| Sets Cookies | http_metadata_sets_cookies |
| SSL/TLS Cipher Suites | ssl_certificate_available_suites |
| SSL/TLS Error | ssl_certificate_sslerror |
| SSL/TLS Expiration | ssl_certificate_valid_to |
| SSL/TLS Fingerprint | ssl_certificate_fingerprint |
| SSL/TLS Issuer Common Name | ssl_certificate_issuer_cn |
| SSL/TLS Issuer Country/Region | ssl_certificate_issuer_c |
| SSL/TLS Issuer Organization | ssl_certificate_issuer_o |
| SSL/TLS Key Length | ssl_certificate_bits |
| SSL/TLS Protocol | ssl_certificate_protocols |
| SSL/TLS Serial Number | ssl_certificate_serial_number |
| SSL/TLS Subject Alt Name | ssl_certificate_subjectaltname |
| SSL/TLS Valid From | ssl_certificate_valid_from |
| Technical Contact Email | whois_data_technical_contact_email |
| Technical Contact Name | whois_data_technical_contact_name |
| Technical Contact Organization | whois_data_technical_contact_organization |
| Type | type |
| Vary | http_metadata_vary |
| WHOIS Status | whois_data_status |
| Zone Contact Email | whois_data_zone_contact_email |
Use this link to download the CSV file for the External Attack Surface Findings Export Mappings.