Unified VRM Instant Search

Available January 21, 2020

InstantSearch, powered by ElasticSearch, provides Unified VRM users with expanded search capabilities and faster results when accessing their vulnerability data. The types of searches and search language rules below allow for more targeted searches to return results fast, even as vulnerability data scales. 

The video below shows how to search for vulnerabilities in Unified VRM that NopSec's machine learning algorithm has prioritized as critical. 

Types of Searches:

There are two ways to easily search using InstantSearch:

• Key:value: 
  • Key:value search must contain a valid key (e.g. asset-group, vuln-name, os) with a paired value that belongs to the key. Examples are:
    • asset-group:DMZ
    • asset-grade:A
    • vuln-name:Oracle
    • age<45
  • **A list of accepted key:value searches can be found in the Search Terms chart below.

• Keyword search: 
  • Keyword search will search across relevant fields and filter out any results that do not contain the keyword. Keyword search can only be used to search across the following attributes:
    • asset ip address
    • asset group name
    • asset os
    • asset hostname
    • asset service
    • vuln name
    • cve

Search Language Rules:

Following the search language rules will prevent incorrect or undesirable search results when querying the vulnerability data. If an invalid key or value is searched for, suggestions for the correct query will be provided. 

• Use quotes for “Multiple Words”.  
  • Space in between text acts as a separator and begins a new search term. Do not add spaces in between values, strings, field names, etc., as this may return undesirable results. 
    • Correct search example:   asset-group:”New York”  would return all asset groups with “New York” in the name.
    • Incorrect search example:  asset-group:New York  would only return asset groups with “New” in the name, and would include results from a separate keyword search for “York”.

• All search terms and values are case insensitive.
  • Example: asset-group-name:”New York”  and   Asset-Group-Name:”new york”  would return the same results

• All queries will return results that contain a partial match unless the query is specified as an exact match using the “:=” operator.
  • Contains example: asset-group-name:”New York” will return all asset groups containing New York in any part of the name. I.e. asset-group-name:”New York” would return the “New York Desktops”, “New York Servers”, and “New York Windows” asset groups.
    • Exact match example: asset-group-name:=”New York”  will only return the “New York” asset group (if it exists).

• All key:value (filter) searches are combined using AND logic. 
  • For example: vulnerability-grade:critical   age<45  will return all vulnerabilities with a critical grade AND that are less than 45 days old.
  • NOTE: users will not be able to enter their own logical operators.
    
    • Incorrect search example: age<90  OR  age>45  
    • Incorrect search example: vulnerability-grade:critical  AND  age<45
  • **Accepted operators listed below.

• Operators: 
  • :  contains
  • :=  exact match
  • >, >=  greater than 
  • <, <= less than
  • <> ranges with multiple values (e.g. age>30 age<60) 

Search Terms Table

The Search Terms Table below provides the accepted keys used for asset and vulnerability filtering.  

Contact info:

For any questions about how to search or filter using InstantSearch, reach out to your NopSec technical account manager or email support@nopsec.com.