Skip to main content
ThreatAware’s search bars all use the same query language, so once you can write a query in one place you can write it anywhere. This page gets you writing queries quickly. Every field, value type and integration prefix is listed in the Query Syntax reference.

​
Where you can use it

Software Inventory’s search box is a plain-text match on product names, not the query language. The Logic Engine uses visual rules instead.

​
The basics

Every condition is a field, a colon and a value:
The operator is always : (not =). Join conditions with AND, OR and NOT, then press Enter to run the query. You rarely need to remember field names. As you type, autocomplete suggests fields (with a short description of each) and, after the :, the values that field accepts. Type a few characters, pick a suggestion with the arrow keys, and repeat.

​
Common queries

Windows devices. os accepts Windows, MacOs or Linux.

​
Vital states are booleans

A common source of confusion: Vital state isn’t a single string. Each integration exposes four boolean fields per device: Compose them with AND for the state you want:

​
Find devices by installed software

Every device carries the software installed on it, so you can find devices by what they run. Put the software conditions inside braces after software::
Inside the braces you can use these fields. Autocomplete suggests them as soon as you type software:{.

​
Wildcards

Product names vary between vendors and tools, so use * to match any characters. *Chrome finds Google Chrome however it’s reported, and *Copilot* finds anything with Copilot in its name.
Devices with any product ending in “Chrome”, such as Google Chrome.
Save the query as a view to keep an eye on it, or track it to follow those devices over time.

​
Natural language

You can also type a question in plain English, such as “Windows devices tagged End-User that don’t have CrowdStrike”. ThreatAware turns it into a query you can see and edit:
Check the query it writes before you save the view or track it.

​
What it can’t do

  • Comparisons such as <, >, <= and >=. For dates, use relative values such as now-7d; see time values.
  • contains, IN (...) and is empty. Use * wildcards for “starts with”, “ends with” or “contains”, and OR instead of IN.
For anything the query language can’t express, use the API.

​
Next steps

Query Syntax reference

Every field, value type and integration prefix

Devices

Where you’ll write most queries, and save them as views

Logic Engine

Visual rules for tags, columns and Custom Vitals