Vulnerability Management Filters

On the Vulnerability Intelligence page and the Vulnerability Profile page, use the Query Builder to refine your results. Show only the CVEs, findings, or affected assets you want to take action on.

The following table lists the filters you can use with the Query Builder and the tabs they appear in.

Filter	Description
ACR	The Tenable-defined Asset Criticality Rating (ACR) as a number from 1 to 10.
AES	The Tenable-defined Asset Exposure Score (AES) as a number from 0 to 1000.
Asset Name	The asset name, for example the IPv4 address 206.206.136.40.
Category	The category, as described in Vulnerability Categories.
Common Name	A vulnerability's common name, for example Log4Shell. Not all vulnerabilies have a common name.
CVE ID	The Common Vulnerabilities and Exposures (CVE) ID, for example CVE-2002-2024.
CVSSv2 Base Score	The CVSSv2 score for the vulnerability, for example 5.2. When not available from NVD, Tenable determines this score. To learn more, see CVSS vs. VPR.
CVSSv3 Attack Complexity	The attack complexity, which defines how difficult it is to use a vulnerability in an attack. Choose from High or Low.
CVSSv3 Attack Vector	The attack vector, which defines an attack's location. Choose from Adjacent, Network, Local, or Physical.
CVSSv3 Availability	The affected asset's availability. Choose from High, Low, or None. For example, an affected asset with High is completely unavailable.
CVSSv3 Base Score	The CVSSv3 score for the vulnerability, for example 4.3. When not available from NVD, Tenable determines this score. To learn more, see CVSS vs. VPR.
CVSSv3 Confidentiality	The expected impact of the affected asset's information confidentiality loss. Choose from High, Low, or None. For example, an affected asset with High may have a catastrophic adverse effect on your organization or customers.
CVSSv3 Integrity	The expected impact of the affected asset's data integrity loss. Choose from High, Low, or None.
CVSSv3 Privileges Required	The permission level attackers require to exploit the vulnerability. Choose from High, Low, or None. None means attackers need no permissions in your environment and can exploit the vulnerability while unauthorized.
CVSSv3 Scope	Whether a vulnerability allows attackers to compromise resources beyond an affected asset's normal authorization privileges. Choose from Unchanged or Changed. Changed means the vulnerability increases the affected asset's privileges.
CVSSv3 User Interaction	Whether a vulnerability requires other users (such as end users) for attackers to be able to use it. Choose from Required or None. None is more severe since it means that no additional user interaction is required.
EPSS Score	The percentage likelihood that a vulnerability will be exploited, based on the third-party Exploit Prediction Scoring System (EPSS). Type a number from 1 to 100 with up to three decimal places, for example, 50.5.
Exploit Maturity	The exploit maturity based on sophistication and availability. This information is drawn from Tenable’s own research as well as key external sources. Choose from High, Functional, PoC, or Unproven.
First Discovered	The date a vulnerability was first identified. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others.
First Functional Exploit	The date a vulnerability was first known to be exploited. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others.
First Proof of Concept	The date a vulnerability's first proof of concept was found. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others.
IPv4 Address	Affected asset IPv4 addresses as a single IP, an IP range, or an IP Classless Inter-Domain Routing (CIDR) block. For example, type 172.16.2.1-172.16.2.100.
IPv6 Address	Affected asset IPv6 addresses as a single IP, an IP range, or an IP Classless Inter-Domain Routing (CIDR) block. For example, type ::ffff:c0a8:102.
Last Seen	The date a finding affected or asset last appeared on a scan. Use Operators to get results based on a date range, a specific date, vulnerabilities older than a date, and others.
Plugins Available	Filter by whether or not a vulnerability currently has a Tenable plugin that detects it. Choose from Yes or No.
Plugin ID	The ID of the Tenable plugin that detected the vulnerability, for example 157288. To look up plugin IDs, go to the Tenable website.
Plugin Name	The name of the Tenable plugin that detected the vulnerability, for example TLS Version 1.1 Protocol Deprecated.
Tags	Tags on your affected assets. To learn more, see Tags.
VPR	The Tenable-calculated Vulnerability Priority Rating (VPR) score, as a number from 1 to 10. Note: A finding's VPR is based on the VPR of the plugin that identified it. When plugins are associated with multiple vulnerabilities, the highest VPR appears.
VPR Threat Intensity	A vulnerability's Tenable-calculated threat intensity based on the number and frequency of threat events. Choose from Very Low, Low, Medium, High, or Very High.
Weaponization	If a vulnerability is judged to be ready for use in a cyberattack. Choose from Advanced Persistent Threat, Botnet, Malware, Ransomware, or Rootkit.
Zero Day	If a vulnerability is a zero-day vulnerability—that is, a vulnerability which has been publicly disclosed or is known to be exploited in the wild before a patch is available. Possible values are Yes or No.