Exposure Response Filters

(Requires Tenable One or Tenable Lumin license) The Tenable-defined Asset Criticality Rating (ACR) as an integer from 1 to 10.

(Requires Tenable One or Tenable Lumin license) The Tenable-defined Asset Exposure Score as an integer from 0 to 1000.

The name of the asset where a scan detected the vulnerability. This value is unique to Tenable Vulnerability Management. This filter is case-sensitive, but you can use the wildcard character to turn this off.

The Common Platform Enumeration (CPE) numbers for vulnerabilities that the plugin identifies.

(200 value limit)

The Common Vulnerability and Exposure (CVE) IDs for the vulnerabilities that the plugin identifies.

(200 value limit)

The Common Vulnerability and Exposure (CVE) IDs for the vulnerabilities associated with the product where the finding was identified (25 value limit).

The Common Vulnerabilities and Exposures (CVE) ID, for example CVE-2002-2024.

A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.

The raw CVSSv2 metrics for the vulnerability. For more information, see the CVSSv2 documentation on the FIRST website.

A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.

The conditions beyond the attacker's control that must exist to exploit the vulnerability.

The resources, access, or specialized conditions required for an attacker to exploit the vulnerability.

The context where vulnerability exploitation is possible, such as Network or Local.

A numeric value between 0.0 and 10.0 that represents the intrinsic characteristics of a vulnerability independent of any specific environment.

The level of privileges an attacker must possess to exploit the vulnerability.

The impact on the availability of systems that can be impacted after the vulnerable system is exploited.

The impact on the confidentiality of systems that can be impacted after the vulnerable system is exploited.

The impact on the integrity of systems that can be impacted after the vulnerable system is exploited.

The level of user involvement required for an attacker to exploit the vulnerability.

The impact on the availability of the vulnerable system when successfully exploited.

The impact on the confidentiality of the vulnerable system when successfully exploited.

The impact on the integrity of the vulnerable system when successfully exploited.

The percentage likelihood that a vulnerability will be exploited, based on the third-party Exploit Prediction Scoring System (EPSS). Type a number from

0 to 100 with up to three decimal places, for example, 75.599.

The unique Tenable ID for the finding. To view the ID for a finding, click its details and check the page URL in your browser's address bar for an alphanumeric string between details and asset.

The date when a scan first found the vulnerability on an asset.

If a fix is available for the corresponding vulnerability. Options are Yes or No.

The last time a previously detected vulnerability was scanned and noted as no longer present on an asset.

Filter on the date that the asset was last observed by any successful scan, including vulnerability scans, configuration scans, and discovery scans. This value can also be the date that the asset was imported into Tenable Vulnerability Management.

The vulnerability's CVSS-based severity when a scan first detected the finding. For more information, see CVSS vs. VPR.

The date on which the vendor published a patch for the vulnerability.

The description of the Tenable plugin that identified the vulnerability.

The family of the plugin that identified the vulnerability.

(200 value limit)

Filter on the ID of the plugin that identified the vulnerability.

(200 value limit)

The date at which the plugin that identified the vulnerability was last updated.

The name of the plugin that identified the vulnerability.

The date on which the plugin that identified the vulnerability was published.

The general type of plugin check. Options are Local, Remote, Local & Remote, Summary, Settings, Reputation, and/or Third Party.

The risk modification applied to the vulnerability's severity. Options are Recast, Accepted, and None. To learn more, see Recast Rules.

Links to external websites that contain helpful information about the vulnerability.

The vulnerability's CVSS-based severity. For more information, see CVSS vs. VPR.

A brief summary of how you can remediate the vulnerability.

The source of the scan that identified the asset. Possible values include Agent for Tenable Agent, Nessus for Tenable Nessus, PVS/NNM for Tenable Network Monitor, and WAS for Tenable Web App Scanning.

The state of the vulnerability detected in the finding. Options are Fixed, Resurfaced, Active, New. Appears in the vulnerability findings query builder by default, with Active, Resurfaced and New selected. For more information, see Vulnerability States.

Filter and organize assets into logical groups (e.g., Network: Headquarters) for easier management and reporting. This filter is case-sensitive. You can add a maximum of 100 tags.

For more information, see Tags.

The Vulnerability Priority Rating that Tenable calculated for the vulnerability.

Filter on a specific CVE ID for the CVE that is a primary contributor to the calculated VPR (Beta) score for a vulnerability.

Allows filtering on CVEs that are part of an exploit chain.

Filter on current availability and maturity of exploit code. Options are High, Functional, POC, and Unproven.

Filter on the probability of exploitation produced by the VPR (Beta) threat model for the CVE.

Allows filtering on the volume of news reporting on the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.

Allows filtering on the recency of news sources reporting on the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.

Filter on categories of news sources that have referenced the CVE within the last 30 days. Select from one or more of Academic and Research Institutions, Blogs and Individual Researchers, Code Repositories, Cybersecurity News Media, Cybersecurity Vendors, Forums and Community Platforms, Government and Regulatory, Mainstream News and Media, Security Research, Technology Companies, Tools and Resources, Other.

Filter on the volume of observed malware exploiting the CVE within the last 30 days. Options are Very Low, Low, Medium, High, Very High.

Filter on the recency of observed malware exploiting the CVE. Options are No Recorded Events, 60 to 180 days, 30 to 60 days, 14 to 30 days, 7 to 14 days, 0 to 7 days.

Filter on whether the CVE is listed on the CISA Known Exploited Vulnerabilities list. Options are Yes, No.

Allows filtering on specific industries where attacks leveraging the CVE have been observed. Sample options include Banking, Technology, Government.

Allows filtering on specific geographic regions where attacks leveraging the CVE have been observed.

Filter on the VPR (Beta) score percentile ranking of the CVE, indicating its position relative to other vulnerabilities.

Filter on the VPR (Beta) severity categorization of the CVE. Options are Critical, High, Medium, Low, Info.

The numerical VPR (Beta) score itself. Allows filtering by specific ranges or values of the updated vulnerability priority rating.

The date when the vulnerability definition was first published (for example, the date that the CVE was published).