Expert query showing software product on recently assessed assets only

InsightVM
1

I’m attempting to create a expert dashboard query to filter only assets that have recently been scanned in the last X amount of days either by agent OR scan time + successful credential status.

Will this nested and statement work for what I’m trying to achieve or is there a simpler way?

Example query below

asset.os.family = 'windows' && asset.software.product = '.net framework 4.5' && (asset.lastAgentConnectionTime >= /NOW - P30D/ || (asset.credentialSuccessStatus = 'true' && asset.lastScanTime >= /NOW - P30D/))
2

I believe I’ve used nested statements like this before and they work fine. I also copied this query and played around with it in the builder, and the results looked valid to me, based on our test environment :+1: