It turns out the ordering of your advanced queries make a difference. The first query provides correct results, but the second does not. So please check your queries since ordering of your nested OR’s are critical.
(asset.os.description CONTAINS ‘microsoft windows’ || asset.os.description CONTAINS ‘ubuntu linux’ || asset.os.description CONTAINS ‘ilo’ || asset.os.description CONTAINS ‘idrac’) && ((asset.vulnerability.severity = ‘critical’) || ( asset.vulnerability.size > 7 && asset.vulnerability.severity = ‘severe’))
=======
((asset.vulnerability.severity = ‘critical’) || ( asset.vulnerability.size > 7 && asset.vulnerability.severity = ‘severe’)) && (asset.os.description CONTAINS ‘microsoft windows’ || asset.os.description CONTAINS ‘ubuntu linux’ || asset.os.description CONTAINS ‘ilo’ || asset.os.description CONTAINS ‘idrac’)