InsightVM Cloud API v4: Multiple parameters in search query

InsightVM API
1

I can successfully get a list of assets using the API call referenced here: InsightVM Cloud Integrations API

I am running into issues when I want to include multiple criteria in the search parameters. For instance. A single condition for an asset and or vulnerability works fine, as formatted here:

{
  "asset": "last_scan_end > 2019-09-04T23:16:57.903Z",
  "vulnerability": "severity IN ['Critical', 'Severe']"
}

But how would I specify an additional condition for asset; for example,
host_name CONTAINS 'abc123.com'

I have tried multiple ways, resulting in an error “Your query string format is not valid.” Some of the unsuccessful variations:

{
  "asset": "host_name CONTAINS 'abc123.com' AND last_scan_end > 2019-09-04T23:16:57.903Z",
  "vulnerability": "severity IN ['Critical', 'Severe']"
}
---
{
  "asset": "host_name CONTAINS 'abc123.com' + last_scan_end > 2019-09-04T23:16:57.903Z",
  "vulnerability": "severity IN ['Critical', 'Severe']"
}
---
{
  "asset": "(host_name CONTAINS 'abc123.com') AND (last_scan_end > 2019-09-04T23:16:57.903Z)",
  "vulnerability": "severity IN ['Critical', 'Severe']"
}
2 Likes
2

did you ever get this workign? R7s api seems to not have all the documentation you would need…

3

So the cloud integration API as far as POSTing an asset search is concerned can use the criteria directly from the Query Builder. If you build your query there first then you can get the correct field names and see the syntax used.

{
  "asset": "asset.name CONTAINS 'abc123.com' && last_scan_end > 2019-09-04T23:16:57.903Z",
  "vulnerability": "severity IN ['Critical', 'Severe']"
}

&& = AND
|| = OR

1 Like
4

I never did get it to work, but the information that John just posted is what I was missing and couldn’t figure out.

5

The AND/OR operator is what I couldn’t figure out. Thank you!

6

yeah i got it working yesturday too, just copied the query exactly, oddly enough my return had slightly more assets, not sure if thats a repliaction issue if im using a different us site

1 Like