Findings Filters

On the Findings page, use the Query Builder to build custom queries that return the findings you need to see.

Tip: For the fastest results, Tenable recommends using the Last Seen filter in all queries to return findings from the last 30 days.

The following table defines the filters you can use. Not all filters are relevant for all findings types.

Filter	Description
ACR	(Requires Tenable One or Tenable Lumin license) The Tenable-defined Asset Criticality Rating (ACR) as an integer from 1 to 10.
AES	(Requires Tenable One or Tenable Lumin license) The Tenable-defined Asset Exposure Score as an integer from 0 to 1000.
Asset ID	The UUID of the asset where a scan detected the finding. This value is unique to Tenable Vulnerability Management.
Asset Name	The name of the asset where a scan detected the vulnerability. This value is unique to Tenable Vulnerability Management. This filter is case-sensitive, but you can use the wildcard character to turn this off.
Asset Tags	Asset tags, entered in pairs of category and value (for example Network: Headquarters). This includes the space after the colon (:). If there is a comma in the tag name, insert a backslash (\) before the comma. If your tag name includes double quotation marks (" "), use the UUID instead. You can add a maximum of 100 tags. For more information, see Tags.
Audit File	The name of Audit file the scanner used to perform the audit. Audit files are XML-based text files that contain the specific configuration, file permission, and access control tests to be performed.
Audit Name	The name Tenable assigned to the audit. In some cases, the compliance control may be listed as the prefix within the name.
Benchmark	Benchmarks are published best practices released from source authorities, such as Center for Internet Security (CIS), United States Defense Information Systems Agency (DISA), and Microsoft. This filter provides a list of the supported benchmarks and the version of the benchmark.
Benchmark Specification Name	The benchmark name.
Benchmark Version	The benchmark version. Use this filter with the Benchmark filter.
Bugtraq ID	The Bugtraq ID for the plugin that identified the vulnerability.
Canvas Exploit	The name of the CANVAS exploit pack that includes the vulnerability.
CERT Advisory ID	The ID of the CERT advisory related to the vulnerability.
CERT Vulnerability ID	The ID of the vulnerability in the CERT Vulnerability Notes Database.
CISA KEV Due Date	The date on which Cybersecurity and Infrastructure Security Agency (CISA) Known Exploitable Vulnerability (KEV) remediation is due, as per Binding Operational Directive 22-01. Searches by the earliest due date for KEVs associated with the plugin. For more information, see the Known Exploited Vulnerabilities Catalog.
Common Name	A vulnerability's common name, for example Log4Shell. Not all vulnerabilities have a common name.
Compliance Control	There are a series of designations within the compliance frameworks that Tenable calls controls. For example: CSF:DE.CM-3, 800-53:AU-12c, STIG-ID:WN10-AU-000045, and so on. This is a text-based field to filter on the specific control(s). Use this filter with the Compliance Framework filter.
Compliance Family Name	There are a series of designations within compliance frameworks that Tenable calls control. For example: ISO/IEC-27001:A.12.4.1, or CSF:DE.CM-1. This filter groups the controls into families for easier and more efficient queries. For example: A12 - Operations security or CSF:Detect. Use this filter with the Compliance Framework filter.
Compliance Framework	Tenable audits configuration compliance with a variety of standards including GDPR, ISO 27000, HIPAA, NIST 800-53, PCI DSS, and so on. This filter allows searching based on the respective framework.
Control ID	An ID that can correlate results with other results that meet a certain benchmark recommendation. You can use this filter to identify checks in the audit portal.
CORE Exploit Framework	Indicates whether an exploit for the vulnerability exists in the CORE Impact framework.
CPE	The Common Platform Enumeration (CPE) numbers for vulnerabilities that the plugin identifies. (200 value limit)
CVE	The Common Vulnerability and Exposure (CVE) IDs for the vulnerabilities identified by the plugin and corresponding to a specific finding. (200 value limit)
CVE (Product)	The Common Vulnerability and Exposure (CVE) IDs for the vulnerabilities on the product where the finding was identified.
CVE Category	The category of a vulnerability, as described in Vulnerability Categories.
CVSSv2 Base Score	A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.
CVSSv2 Temporal Vector	CVSSv2 temporal metrics for the vulnerability.
CVSSv2 Vector	The raw CVSSv2 metrics for the vulnerability. For more information, see the CVSSv2 documentation on the FIRST website.
CVSSv3 Attack Complexity	The attack complexity, which defines how difficult it is to use a vulnerability in an attack. Choose from High or Low.
CVSSv3 Attack Vector	The attack vector, which defines an attack's location. Choose from Adjacent, Network, Local, or Physical.
CVSSv3 Availability	The affected asset's availability. Choose from High, Low, or None. For example, High means an asset is completely unavailable.
CVSSv3 Base Score	A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.
CVSSv3 Confidentiality	The expected impact of the affected asset's information confidentiality loss. Choose from High, Low, or None. For example, an affected asset with High confidentiality may have a catastrophic adverse effect on your organization or customers.
CVSSv3 Integrity	The expected impact of the affected asset's data integrity loss. Choose from High, Low, or None.
CVSSv3 Privileges Required	The permission level attackers require to exploit the vulnerability. Choose from High, Low, or None. None means attackers need no permissions in your environment and can exploit the vulnerability while unauthorized.
CVSSv3 Scope	If a vulnerability allows attackers to compromise resources beyond an affected asset's normal authorization privileges. Choose from Unchanged or Changed. Changed means the vulnerability increases the affected asset's privileges.
CVSSv3 Temporal Score	The CVSSv3 temporal score (characteristics of a vulnerability that change over time but not among user environments).
CVSSv3 Temporal Vector	CVSSv3 temporal metrics for the vulnerability.
CVSSv3 User Interaction	If a vulnerability requires other users (such as end users) for attackers to be able to use it. Choose from Required or None. None is more severe since it means no additional user interaction is required.
CVSSv3 Vector	More CVSSv3 metrics for the vulnerability.
CVSSv4 Attack Complexity (AC)	The conditions beyond the attacker's control that must exist to exploit the vulnerability.
CVSSv4 Attack Requirements (AT)	The resources, access, or specialized conditions required for an attacker to exploit the vulnerability.
CVSSv4 Attack Vector (AV)	The context where vulnerability exploitation is possible, such as Network or Local.
CVSSv4 Base Score	A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.
CVSSv4 Privileges Required (PR)	The level of privileges an attacker must possess to exploit the vulnerability.
CVSSv4 Subsequent System Availability Impact (VA)	The impact on the availability of systems that can be impacted after the vulnerable system is exploited.
CVSSv4 Subsequent System Confidentiality Impact (SC)	The impact on the confidentiality of systems that can be impacted after the vulnerable system is exploited.
CVSSv4 Subsequent System Integrity Impact (SI)	The impact on the integrity of systems that can be impacted after the vulnerable system is exploited.
CVSSv4 User Interaction	The level of user involvement required for an attacker to exploit the vulnerability.
CVSSv4 Vulnerable System Availability Impact	The impact on the availability of the vulnerable system when successfully exploited.
CVSSv4 Vulnerable System Confidentiality Impact (VC)	The impact on the confidentiality of the vulnerable system when successfully exploited.
CVSSv4 Vulnerable System Integrity Impact (VI)	The impact on the integrity of the vulnerable system when successfully exploited.
CWE	The Common Weakness Enumeration (CWE) for the vulnerability.
Default/Known Account	Indicates whether the plugin that identified the vulnerability checks for default accounts.
Elliot Exploit	The name of the exploit for the vulnerability in the D2 Elliot Web Exploitation framework.
EPSS Score	The percentage likelihood that a vulnerability will be exploited, based on the third-party Exploit Prediction Scoring System (EPSS). Type a number from 0 to 1 with up to five decimal places, for example, 0.505.
Exploit Database ID	The ID of the vulnerability in the Exploit Database.
Exploit Maturity	The exploit maturity based on sophistication and availability. This information is drawn from Tenable’s own research as well as key external sources. Choose from High, Functional, PoC, or Unproven.
Exploitability Ease	A description of how easy it is to exploit the vulnerability.
Exploited By Malware	Indicates whether the vulnerability is known to be exploited by malware.
Exploited By Nessus	Indicates whether Tenable Nessus exploited the vulnerability during the process of identification.
ExploitHub	Indicates whether an exploit for the vulnerability exists in the ExploitHub framework.
Finding ID	The unique Tenable ID for the finding. To view the ID for a finding, click its details and check the page URL in your browser's address bar for an alphanumeric string between details and asset.
First Audited	Identifies the first date the audit check was performed on the asset.
First Discovered	The date the vulnerability corresponding to a finding was first identified.
First Functional Exploit	The date a vulnerability was first known to be exploited.
First Proof of Concept	The date a vulnerability's first proof of concept was found.
First Seen	The date when a scan first found the vulnerability on an asset.
Fix Available	If a fix is available for the corresponding vulnerability. Choose from Yes or No.
FQDNs	The fully qualified domain names (FQDNs) for the asset.
IAVA ID	The ID of the information assurance vulnerability alert (IAVA) for the vulnerability.
IAVB ID	The ID of the information assurance vulnerability bulletin (IAVB) for the vulnerability.
IAVM Severity	The severity of the vulnerability in Information Assurance Vulnerability Management (IAVM).
IAVT ID	The ID of the information assurance vulnerability technical bulletin (IAVT) for the vulnerability.
In The News	Indicates whether this plugin has received media attention (for example, ShellShock, Meltdown).
Input Name	The name of the specific web application component that the vulnerability exploits.
Input Type	The web application component type (for example, form, cookie, header) that the vulnerability exploits.
IPv4 Address	The IPv4 address for the affected asset. You can add up to 100 IP addresses to this filter.
IPv6 Address	The IPv6 address for the affected asset.
Last Audited	Identifies the date of the most recent audit check performed on the asset.
Last Fixed	The last time a previously detected vulnerability was scanned and noted as no longer present on an asset.
Last Seen	The date when a scan last found the vulnerability on an asset.
Malware	Indicates whether the plugin that identified the vulnerability checks for malware.
Metasploit Exploit	The name of the related exploit in the Metasploit framework.
Microsoft Bulletin	The Microsoft security bulletin that the plugin, which identified the vulnerability, covers.
Network	The name of the network object associated with scanners that identified the asset. The default name is Default. For more information, see Networks.
Original Result	The result from the initial audit.
Original Severity	The vulnerability's CVSS-based severity when a scan first detected the finding. For more information, see CVSS vs. VPR.
OSVDB ID	The ID of the vulnerability in the Open Sourced Vulnerability Database (OSVDB).
OWASP 2010	The Open Web Application Security Project (OWASP) 2010 category for the vulnerability targeted by the plugin.
OWASP 2013	The Open Web Application Security Project (OWASP) 2013 category for the vulnerability targeted by the plugin.
OWASP 2017	The Open Web Application Security Project (OWASP) 2017 category for the vulnerability targeted by the plugin.
OWASP 2021	The Open Web Application Security Project (OWASP) 2021 category for the vulnerability targeted by the plugin.
OWASP API 2019	The Open Web Application Security Project (OWASP) 2019 category for the API vulnerability targeted by the plugin.
Path	The installation path of the software with the vulnerability. To get results, you must enter a complete installation path.
Patch	If a patch is available for the vulnerability.
Patch Published	The date on which the vendor published a patch for the vulnerability.
Plugin Description	The description of the Tenable plugin that identified the vulnerability.
Plugin Family	The family of the plugin that identified the vulnerability. (200 value limit)
Plugin ID	The ID of the plugin that identified the vulnerability. (200 value limit)
Plugin Modification Date	The date at which the plugin that identified the vulnerability was last modified.
Plugin Name	The name of the plugin that identified the vulnerability.
Plugin Output	Use this filter to return findings with plugin output you specify. Search for plugin output that contains a value or does not contain it, as described in Use Filters. If your search is too broad, the system suggests adding Plugin ID and Last Seen to refine the results and then displays the top ten plugins from that search. For example, to search for output that contains “Kernel,” in Advanced mode, type: Plugin Output contains Kernel Note: Manually enable this filter in Settings > General Search > Enable Plugin Output Search. If you do not use this filter for 35 days, it is disabled again. Plugin Output search best practices... Since plugin outputs can be large, broad searches may cause system timeouts! For the best results, combine the Plugin Output filter with the Plugin ID and Last Seen filters. Limit the number of plugin IDs you search at once. Specify plugin ID(s) to search for plugins or exclude them. These approaches apply to different use cases. For example, include plugins when searching for software listings by operating system. Exclude plugins from exploratory searches where the top plugins appear too frequently. Search for output from one plugin: Plugin Output contains Kernel AND Plugin ID is equal to 110483 Search for output from multiple plugins: Plugin Output contains Chrome AND Plugin ID is equal to 45590, 10456 Search for output from any plugin but the ones listed: Plugin Output contains Chrome AND Plugin ID is not equal to 45590, 10456
Plugin Published	The date on which the plugin that identified the vulnerability was published.
Plugin Type	The general type of plugin check. Possible options are Local, Remote, and Local & Remote.
Plugins Available	If a vulnerability currently has a Tenable plugin that detects it. Choose from Yes or No.
Port	Information about the port the scanner used to connect to the asset where the scan detected the vulnerability. (200 value limit)
Product	The name of the product on which the vulnerability was detected.
Product Type	The type of product, for example, Application.
Protocol	The protocol the scanner used to communicate with the asset where the scan detected the vulnerability.
Result	The current or modified result from the audit check.
Result Modified	Rules can be created to accept or modify the results of an audit check. This filter allows you to report modified results.
Resurfaced Date	The most recent date that a scan detected a Resurfaced vulnerability which was previously Fixed. If a vulnerability is Resurfaced multiple times, only the most recent date appears.
Risk Modified	The risk modification applied to the vulnerability's severity. Possible options are Recasted, Accepted, and None. To learn more, see Recast Rules.
Scan Origin	The scanner that detected the finding.
Secunia ID	The ID of the Secunia research advisory related to the vulnerability.
See Also	Links to external websites that contain helpful information about the vulnerability.
Severity	The vulnerability's CVSS-based severity. For more information, see CVSS vs. VPR.
Solution	A brief summary of how you can remediate the vulnerability.
Source	The source of the scan that identified the asset. Possible values include Agent for Tenable Agent, Nessus for Tenable Nessus, PVS/NNM for Tenable Network Monitor, and WAS for Tenable Web App Scanning.
State	The state of the vulnerability detected in the finding. Appears in the filters plane by default, with Active, Resurfaced, and New selected. For more information, see Vulnerability States.
Stig Severity	The STIG severity associated with the finding.
Synopsis	A brief description of the plugin or vulnerability.
Time Taken to Fix	How long it took your organization to fix a vulnerability identified on a scan, in hours or days. Only appears for Fixed vulnerabilities. Use this filter along with the State filter set to Fixed for more accurate results. When exported, this field is shown in milliseconds.
Unsupported by Vendor	Software found by this plugin is unsupported by the software's vendor (for example, Windows 95 or Firefox 3).
URL	The complete URL on which the scanner detected the vulnerability.
Vendor	The vendor who makes the product on which the vulnerability was identified, for example, Apache.
Vendor Severity	The severity of a vulnerability as assigned by a CVE Numbering Authority (CNA). Unlike a National Vulnerability Database (NVD) score, which reflects the worst-case scenario, this rating accounts for mitigations.
Version	The version of the product on which the vulnerability was identified.
VPR	The Vulnerability Priority Rating Tenable calculated for the vulnerability.
VPR Threat Intensity	A vulnerability's Tenable-calculated threat intensity based on the number and frequency of threat events. Choose from Very Low, Low, Medium, High, or Very High.
Vulnerability Published	The date when the vulnerability definition was first published (for example, the date that the CVE was published).
WASC	The Web Application Security Consortium (WASC) category associated with the vulnerability targeted by the plugin.
Weaponization	If a vulnerability is judged to be ready for use in a cyberattack. Choose from Advanced Persistent Threat, Botnet, Malware, Ransomware, or Rootkit.
Workaround	If a workaround is available for the vulnerability.
Workaround Type	The type of workaround available, if relevant. Possible values are Configuration Change and Disable Service.