Findings Filters

On the Findings tab in Explore, use the query builder to build custom queries that return the findings you need to see.

Tip: For the fastest results, Tenable recommends using the Last Seen filter in all queries to return findings from the last 30 days.

The following table defines the filters you can use. This table explains the applicability of each filter, detailing which finding types may utilize each specific filter within queries.

Filter	Finding Type(s)	Description
ACR	Vulnerabilities	(Requires Tenable One or Tenable Lumin license) The Tenable-defined Asset Criticality Rating (ACR) as an integer from 1 to 10.
AES	Vulnerabilities	(Requires Tenable One or Tenable Lumin license) The Tenable-defined Asset Exposure Score as an integer from 0 to 1000.
Asset ID	All	The UUID of the asset where a scan detected the finding. This value is unique to Tenable Vulnerability Management.
Asset Name	All	The name of the asset where a scan detected the vulnerability. This value is unique to Tenable Vulnerability Management. This filter is case-sensitive, but you can use the wildcard character to turn this off.
Audit File	Host Audits	The name of Audit file the scanner used to perform the audit. Audit files are XML-based text files that contain the specific configuration, file permission, and access control tests to be performed.
Audit Name	Host Audits	The name Tenable assigned to the audit. In some cases, the compliance control may be listed as the prefix within the name.
Benchmark	Host Audits	Benchmarks are published best practices released from source authorities, such as Center for Internet Security (CIS), United States Defense Information Systems Agency (DISA), and Microsoft. This filter provides a list of the supported benchmarks and the version of the benchmark.
Benchmark Specification Name	Host Audits	The benchmark name.
Benchmark Version	Host Audits	The benchmark version. Use this filter with the Benchmark filter.
Bugtraq ID	Web Application Findings, Vulnerabilities	The Bugtraq ID for the plugin that identified the vulnerability.
Canvas Exploit	Vulnerabilities	The name of the CANVAS exploit pack that includes the vulnerability.
Categories	Vulnerabilities	The categories of software vulnerabilities. Possible values are displayed in the Query builder.
CERT Advisory ID	Vulnerabilities	The ID of the CERT advisory related to the vulnerability.
CERT Vulnerability ID	Vulnerabilities	The ID of the vulnerability in the CERT Vulnerability Notes Database.
CISA KEV Due Date	Vulnerabilities	The date on which Cybersecurity and Infrastructure Security Agency (CISA) Known Exploitable Vulnerability (KEV) remediation is due, as per Binding Operational Directive 22-01. Searches by the earliest due date for KEVs associated with the plugin. For more information, see the Known Exploited Vulnerabilities Catalog.
Common Name	Vulnerabilities	A vulnerability's common name, for example Log4Shell. Not all vulnerabilities have a common name.
Compliance Control	Host Audits	There are a series of designations within the compliance frameworks that Tenable calls controls. For example: CSF:DE.CM-3, 800-53:AU-12c, STIG-ID:WN10-AU-000045, and so on. This is a text-based field to filter on the specific control(s). Use this filter with the Compliance Framework filter.
Compliance Family Name	Host Audits	There are a series of designations within compliance frameworks that Tenable calls control. For example: ISO/IEC-27001:A.12.4.1, or CSF:DE.CM-1. This filter groups the controls into families for easier and more efficient queries. For example: A12 - Operations security or CSF:Detect. Use this filter with the Compliance Framework filter.
Compliance Framework	Host Audits	Tenable audits configuration compliance with a variety of standards including GDPR, ISO 27000, HIPAA, NIST 800-53, PCI DSS, and so on. This allows filtering based on the respective framework.
Control ID	Host Audits	An ID for correlating results with other results that meet a certain benchmark recommendation. You can use this filter to identify checks in the audit portal.
CORE Exploit Framework	Vulnerabilities	Indicates whether an exploit for the vulnerability exists in the CORE Impact framework.
CPE	Web Application Findings, Vulnerabilities	The Common Platform Enumeration (CPE) numbers for vulnerabilities that the plugin identifies. (200 value limit)
CVE	Web Application Findings, Vulnerabilities	The Common Vulnerability and Exposure (CVE) IDs for the vulnerabilities identified by the plugin and corresponding to a specific finding. (200 value limit)
CVE (Product)	Vulnerabilities	The Common Vulnerability and Exposure (CVE) IDs for the vulnerabilities on the product where the finding was identified.
CVE Category	Vulnerabilities	The category of a vulnerability, as described in Vulnerability Categories.
CVSSv2 Base Score	Web Application Findings, Vulnerabilities	A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.
CVSSv2 Temporal Score	Vulnerabilities	The CVSSv2 Temporal Score reflects the current real-world severity of a vulnerability, adjusting the Base Score based on factors that change over time.
CVSSv2 Temporal Vector	Web Application Findings, Vulnerabilities	CVSSv2 temporal metrics for the vulnerability.
CVSSv2 Vector	Vulnerabilities	The raw CVSSv2 metrics for the vulnerability. For more information, see the CVSSv2 documentation on the FIRST website.
CVSSv3 Attack Complexity	Vulnerabilities	The attack complexity, which defines how difficult it is to use a vulnerability in an attack. Options are High or Low.
CVSSv3 Attack Vector	Vulnerabilities	The attack vector, which defines an attack's location. Options are Adjacent, Network, Local, or Physical.
CVSSv3 Availability	Vulnerabilities	Quantifies the impact on the availability of the affected asset. Options are High (the asset is completely unavailable), Low (some reduced performance or interruption in availability), or None (no impact on the availability of the asset).
CVSSv3 Base Score	Web Application Findings, Vulnerabilities	A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.
CVSSv3 Confidentiality	Vulnerabilities	The expected impact of the affected asset's information confidentiality loss. Options are High, Low, or None. For example, an affected asset with High confidentiality may have a catastrophic adverse effect on your organization or customers.
CVSSv3 Integrity	Vulnerabilities	The expected impact of the affected asset's data integrity loss. Options are High, Low, or None.
CVSSv3 Privileges Required	Vulnerabilities	The permission level attackers require to exploit the vulnerability. Options are High, Low, or None. For example, None means attackers need no permissions in your environment and can exploit the vulnerability while unauthorized.
CVSSv3 Scope	Vulnerabilities	If a vulnerability allows attackers to compromise resources beyond an affected asset's normal authorization privileges. Options are Unchanged or Changed. For example, Changed means the vulnerability increases the affected asset's privileges.
CVSSv3 Temporal Score	Vulnerabilities	The CVSSv3 temporal score (characteristics of a vulnerability that change over time but not among user environments).
CVSSv3 Temporal Vector	Vulnerabilities	CVSSv3 temporal metrics for the vulnerability.
CVSSv3 User Interaction	Vulnerabilities	If a vulnerability requires other users (such as end users) for attackers to be able to use it. Options are Required or None. None is more severe since it means no additional user interaction is required.
CVSSv3 Vector	Web Application Findings, Vulnerabilities	More CVSSv3 metrics for the vulnerability.
CVSSv4 Attack Complexity (AC)	Web Application Findings, Vulnerabilities	The conditions beyond the attacker's control that must exist to exploit the vulnerability.
CVSSv4 Attack Requirements (AT)	Web Application Findings, Vulnerabilities	The resources, access, or specialized conditions required for an attacker to exploit the vulnerability.
CVSSv4 Attack Vector (AV)	Web Application Findings, Vulnerabilities	The context where vulnerability exploitation is possible, such as Network or Local.
CVSSv4 Base Score	Web Application Findings, Vulnerabilities	A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.
CVSSv4 Privileges Required (PR)	Web Application Findings, Vulnerabilities	The level of privileges an attacker must possess to exploit the vulnerability.
CVSSv4 Subsequent System Availability Impact (SA)	Web Application Findings, Vulnerabilities	The impact on the availability of systems that can be impacted after the vulnerable system is exploited.
CVSSv4 Subsequent System Confidentiality Impact (SC)	Web Application Findings, Vulnerabilities	The impact on the confidentiality of systems that can be impacted after the vulnerable system is exploited.
CVSSv4 Subsequent System Integrity Impact (SI)	Web Application Findings, Vulnerabilities	The impact on the integrity of systems that can be impacted after the vulnerable system is exploited.
CVSSv4 User Interaction (UI)	Web Application Findings, Vulnerabilities	The level of user involvement required for an attacker to exploit the vulnerability.
CVSSv4 Vulnerable System Availability Impact (VA)	Web Application Findings, Vulnerabilities	The impact on the availability of the vulnerable system when successfully exploited.
CVSSv4 Vulnerable System Confidentiality Impact (VC)	Web Application Findings, Vulnerabilities	The impact on the confidentiality of the vulnerable system when successfully exploited.
CVSSv4 Vulnerable System Integrity Impact (VI)	Web Application Findings, Vulnerabilities	The impact on the integrity of the vulnerable system when successfully exploited.
CWE	Web Application Findings, Vulnerabilities	The Common Weakness Enumeration (CWE) for the vulnerability.
Default/Known Account	Vulnerabilities	Indicates whether the plugin that identified the vulnerability checks for default accounts.
Elliot Exploit	Vulnerabilities	The name of the exploit for the vulnerability in the D2 Elliot Web Exploitation framework.
EPSS Score	Vulnerabilities	The percentage likelihood that a vulnerability will be exploited, based on the third-party Exploit Prediction Scoring System (EPSS). Type a number from 0 to 100 with up to three decimal places, for example, 75.599.
Exploit Database ID	Vulnerabilities	The ID of the vulnerability in the Exploit Database.
Exploit Maturity	Vulnerabilities	The exploit maturity based on sophistication and availability. This information is drawn from Tenable’s own research as well as key external sources. Options are High, Functional, PoC, or Unproven.
Exploitability Ease	Vulnerabilities	A description of how easy it is to exploit the vulnerability.
Exploited By Malware	Vulnerabilities	Indicates whether the vulnerability is known to be exploited by malware.
Exploited By Nessus	Vulnerabilities	Indicates whether Tenable Nessus exploited the vulnerability during the process of identification.
ExploitHub	Vulnerabilities	Indicates whether an exploit for the vulnerability exists in the ExploitHub framework.
Finding ID	Vulnerabilities	The unique Tenable ID for the finding. To view the ID for a finding, click its details and check the page URL in your browser's address bar for an alphanumeric string between details and asset.
First Audited	Host Audits	Identifies the first date the audit check was performed on the asset.
First Discovered	Vulnerabilities	The date the vulnerability corresponding to a finding was first identified.
First Functional Exploit	Vulnerabilities	The date a vulnerability was first known to be exploited.
First Proof of Concept	Vulnerabilities	The date a vulnerability's first proof of concept was found.
First Seen	Web Application Findings, Vulnerabilities	The date when a scan first found the vulnerability on an asset.
Fix Available	Vulnerabilities	If a fix is available for the corresponding vulnerability. Options are Yes or No.
FQDNs	Host Audits	The fully qualified domain names (FQDNs) for the asset.
IAVA ID	Vulnerabilities	The ID of the information assurance vulnerability alert (IAVA) for the vulnerability.
IAVB ID	Vulnerabilities	The ID of the information assurance vulnerability bulletin (IAVB) for the vulnerability.
IAVM Severity	Vulnerabilities	The severity of the vulnerability in Information Assurance Vulnerability Management (IAVM).
IAVT ID	Vulnerabilities	The ID of the information assurance vulnerability technical bulletin (IAVT) for the vulnerability.
In The News	Vulnerabilities	Indicates whether this plugin has received media attention (for example, ShellShock, Meltdown).
Input Name	Web Application Findings	The name of the specific web application component that the vulnerability exploits.
Input Type	Web Application Findings	The web application component type (for example, form, cookie, header) that the vulnerability exploits.
IPv4 Address	All	The IPv4 address for the affected asset. You can add up to 100 IP addresses to this filter.
IPv6 Address	Host Audits, Vulnerabilities	The IPv6 address for the affected asset.
Last Authenticated Scan	Vulnerabilities	The time and date that a credentialed scan was last performed on the asset.
Last Audited	Host Audits	Identifies the date of the most recent audit check performed on the asset.
Last Fixed	All	The last time a previously detected vulnerability was scanned and noted as no longer present on an asset.
Last Seen	Web Application Findings, Vulnerabilities	The date when a scan last found the vulnerability on an asset.
Live Result	Vulnerabilities	TBD
Malware	Vulnerabilities	Indicates whether the plugin that identified the vulnerability checks for malware.
Metasploit Exploit	Vulnerabilities	The name of the related exploit in the Metasploit framework.
Microsoft Bulletin	Vulnerabilities	The Microsoft security bulletin that the plugin, which identified the vulnerability, covers.
Network	Vulnerabilities	The name of the network object associated with scanners that identified the asset. The default name is Default. For more information, see Networks.
Operating Systems	Host Audits, Vulnerabilities	The operating systems installed on the asset.
Original Result	Host Audits	The result from the initial audit.
Original Severity	Web Application Findings, Vulnerabilities	The vulnerability's CVSS-based severity when a scan first detected the finding. For more information, see CVSS vs. VPR.
OSVDB ID	Vulnerabilities	The ID of the vulnerability in the Open Sourced Vulnerability Database (OSVDB).
OWASP 2010	Web Application Findings	The Open Web Application Security Project (OWASP) 2010 category for the vulnerability targeted by the plugin.
OWASP 2013	Web Application Findings	The Open Web Application Security Project (OWASP) 2013 category for the vulnerability targeted by the plugin.
OWASP 2017	Web Application Findings	The Open Web Application Security Project (OWASP) 2017 category for the vulnerability targeted by the plugin.
OWASP 2021	Web Application Findings	The Open Web Application Security Project (OWASP) 2021 category for the vulnerability targeted by the plugin.
OWASP API 2019	Web Application Findings	The Open Web Application Security Project (OWASP) 2019 category for the API vulnerability targeted by the plugin.
Patch	Vulnerabilities	If a patch is available for the vulnerability.
Patch Published	Vulnerabilities	The date on which the vendor published a patch for the vulnerability.
Path	Vulnerabilities	The complete installation path of the software where a vulnerability was detected.
Plugin Description	Web Application Findings, Vulnerabilities	The description of the Tenable plugin that identified the vulnerability.
Plugin Family	Web Application Findings, Vulnerabilities	The family of the plugin that identified the vulnerability. (200 value limit)
Plugin ID	All	The ID of the plugin that identified the vulnerability. (200 value limit)
Plugin Updated	Web Application Findings, Vulnerabilities	The date at which the plugin that identified the vulnerability was last updated.
Plugin Name	All	The name of the plugin that identified the vulnerability.
Plugin Output	Vulnerabilities	Use this filter to return findings with plugin output that you specify. Search for a value in the plugin output using the contains or does not contain operator, as described in Use Filters. Caution: Due to technical constraints in how the underlying system processes large data in JSON format, only the first 20,000,000 characters of raw plugin data are available when searching plugin output. If your search is too broad, the system suggests adding Plugin ID and Last Seen to refine the results and then displays the top ten plugins from that search. For example, to search for output that contains “Kernel,” in Advanced mode, type: Plugin Output contains Kernel Note: Manually enable this filter in Settings > General Search > Enable Plugin Output Search. If you do not use this filter for 35 days, it is disabled again. Plugin Output search best practices... Since plugin outputs can be large, broad searches may cause system timeouts! For the best results, combine the Plugin Output filter with the Plugin ID and Last Seen filters. Limit the number of plugin IDs you search at once. Specify plugin ID(s) to search for plugins or exclude them. These approaches apply to different use cases. For example, include plugins when searching for software listings by operating system. Exclude plugins from exploratory searches where the top plugins appear too frequently. Search for output from one plugin: Plugin Output contains Kernel AND Plugin ID is equal to 110483 Search for output from multiple plugins: Plugin Output contains Chrome AND Plugin ID is equal to 45590, 10456 Search for output from any plugin but the ones listed: Plugin Output contains Chrome AND Plugin ID is not equal to 45590, 10456
Plugin Published	Web Application Findings, Vulnerabilities	The date on which the plugin that identified the vulnerability was published.
Plugin Type	Vulnerabilities	The general type of plugin check. Options are Local, Remote, Local & Remote, Summary, Settings, Reputation, and/or Third Party.
Plugins Available	Vulnerabilities	If a vulnerability currently has a Tenable plugin that detects it. Options are Yes or No.
Port	Vulnerabilities	Information about the port the scanner used to connect to the asset where the scan detected the vulnerability. (200 value limit)
Product	Vulnerabilities	The name of the product on which the vulnerability was detected.
Product Type	Vulnerabilities	The type of product. Options are Application, Hardware, Operating System, Package.
Protocol	Vulnerabilities	The protocol the scanner used to communicate with the asset where the scan detected the vulnerability.
Result	Host Audits	The current or modified result from the audit check.
Result Modified	Host Audits	Rules can be created to accept or modify the results of an audit check. This filter allows you to report modified results.
Resurfaced Date	Vulnerabilities	The most recent date that a scan detected a Resurfaced vulnerability which was previously Fixed. If a vulnerability is Resurfaced multiple times, only the most recent date appears.
Risk Modified	Web Application Findings, Vulnerabilities	The risk modification applied to the vulnerability's severity. Options are Recast, Accepted, and None. To learn more, see Recast Rules.
Scan Origin	Vulnerabilities	The scanner that detected the finding.
Secunia ID	Vulnerabilities	The ID of the Secunia research advisory related to the vulnerability.
See Also	Web Application Findings, Vulnerabilities	Links to external websites that contain helpful information about the vulnerability.
Severity	Web Application Findings, Vulnerabilities	The vulnerability's CVSS-based severity. For more information, see CVSS vs. VPR.
Software Information	Vulnerabilities	A collection of fields available in Findings Columns that includes Fix, Fix Type, Path, Product, Product Type, Vendor, and Version.
Solution	Web Application Findings, Vulnerabilities	A brief summary of how you can remediate the vulnerability.
Source	Vulnerabilities	The source of the scan that identified the asset. Possible values include Agent for Tenable Agent, Nessus for Tenable Nessus, PVS/NNM for Tenable Network Monitor, and WAS for Tenable Web App Scanning.
State	Web Application Findings, Vulnerabilities	The state of the vulnerability detected in the finding. Options are Fixed, Resurfaced, Active, New. Appears in the vulnerability findings query builder by default, with Active, Resurfaced and New selected. For more information, see Vulnerability States.
Stig Severity	Vulnerabilities	The STIG severity associated with the finding.
Synopsis	Vulnerabilities	A brief description of the plugin or vulnerability.
Tags	Vulnerabilities	Asset tags, entered in pairs of category and value (for example Network: Headquarters). This includes the space after the colon (:). If there is a comma in the tag name, insert a backslash (\) before the comma. If your tag name includes double quotation marks (" "), use the UUID instead. You can add a maximum of 100 tags. For more information, see Tags.
Time Taken to Fix	Vulnerabilities	How long it took your organization to fix a vulnerability identified on a scan in days. Only appears for Fixed vulnerabilities. Use this filter along with the State filter set to Fixed for more accurate results. When exported, this field is shown in milliseconds.
Unsupported by Vendor	Vulnerabilities	Software found by this plugin is unsupported by the software's vendor (for example, Windows 95 or Firefox 3).
URL	Web Application Findings	The complete URL on which the scanner detected the vulnerability.
Vendor	Vulnerabilities	The vendor who makes the product on which the vulnerability was identified, for example, Apache.
Vendor Severity	Vulnerabilities	The severity of a vulnerability as assigned by a CVE Numbering Authority (CNA). Unlike a National Vulnerability Database (NVD) score, which reflects the worst-case scenario, this rating accounts for mitigations.
Version	Vulnerabilities	The version of the product on which the vulnerability was identified.
VPR	Web Application Findings, Vulnerabilities	The Vulnerability Priority Rating that Tenable calculated for the vulnerability.
VPR (Beta) Key Driver CVE ID	Web Application Findings, Vulnerabilities	Filter on a specific CVE ID for the CVE that is a primary contributor to the calculated VPR (Beta) score for a vulnerability.
VPR (Beta) Key Driver Exploit Chain	Web Application Findings, Vulnerabilities	Allows filtering on CVEs that are part of an exploit chain.
VPR (Beta) Key Driver Code Maturity	Web Application Findings, Vulnerabilities	Filter on current availability and maturity of exploit code. Options are High, Functional, POC, and Unproven.
VPR (Beta) Key Driver Probability	Web Application Findings, Vulnerabilities	Filter on the probability of exploitation produced by the VPR (Beta) threat model for the CVE.
VPR (Beta) Key Driver In the News Intensity, last 30 days	Web Application Findings, Vulnerabilities	Allows filtering on the volume of news reporting on the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.
VPR (Beta) Key Driver In the News Recency	Web Application Findings, Vulnerabilities	Allows filtering on the recency of news sources reporting on the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.
VPR (Beta) Key Driver In the News Sources, last 30 days	Web Application Findings, Vulnerabilities	Filter on categories of news sources that have referenced the CVE within the last 30 days. Select from one or more of Academic and Research Institutions, Blogs and Individual Researchers, Code Repositories, Cybersecurity News Media, Cybersecurity Vendors, Forums and Community Platforms, Government and Regulatory, Mainstream News and Media, Security Research, Technology Companies, Tools and Resources, Other.
VPR (Beta) Key Driver Malware Observations Intensity, last 30 days	Web Application Findings, Vulnerabilities	Filter on the volume of observed malware exploiting the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.
VPR (Beta) Key Driver Malware Observations Recency	Web Application Findings, Vulnerabilities	Filter on the recency of observed malware exploiting the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.
VPR (Beta) Key Driver On CISA KEV	Web Application Findings, Vulnerabilities	Filter on whether the CVE is listed on the CISA Known Exploited Vulnerabilities list. Options are Yes, No.
VPR (Beta) Key Driver Targeted Industries	Web Application Findings, Vulnerabilities	Allows filtering on specific industries where attacks leveraging the CVE have been observed. Sample options include Banking, Technology, Government.
VPR (Beta) Key Driver Targeted Regions	Web Application Findings, Vulnerabilities	Allows filtering on specific geographic regions where attacks leveraging the CVE have been observed.
VPR (Beta) Key Driver VPR Percentile	Web Application Findings, Vulnerabilities	Filter on the VPR (Beta) score percentile ranking of the CVE, indicating its position relative to other vulnerabilities.
VPR (Beta) Key Driver VPR Severity	Web Application Findings, Vulnerabilities	Filter on the VPR (Beta) severity categorization of the CVE. Options are Critical, High, Medium, Low, Info.
VPR (Beta)	Web Application Findings, Vulnerabilities	The numerical VPR (Beta) score itself. Allows filtering by specific ranges or values of the updated vulnerability priority rating.
VPR Threat Intensity	Vulnerabilities	A vulnerability's Tenable-calculated threat intensity based on the number and frequency of threat events. Options are Very Low, Low, Medium, High, or Very High.
Vuln SLA Date	Vulnerabilities, Web Application Findings	The date that the finding was last activated. It equals either the First Seen date when the finding is new or active or the Resurfaced Date if the finding is resurfaced.
Vulnerability Published	Vulnerabilities	The date when the vulnerability definition was first published (for example, the date that the CVE was published).
WASC	Web Application Findings	The Web Application Security Consortium (WASC) category associated with the vulnerability targeted by the plugin.
Weaponization	Vulnerabilities	If a vulnerability is judged to be ready for use in a cyberattack. Options are Advanced Persistent Threat, Botnet, Malware, Ransomware, or Rootkit.
Workaround	Vulnerabilities	If a workaround is available for the vulnerability.
Workaround Type	Vulnerabilities	The type of workaround available, if relevant. Possible values are Configuration Change and Disable Service.