Advanced Search

You have selected 0 posts.

5.2k views
12 likes
4 links
6 users

post by mdodgson on Feb 25, 2020

Mark Dodgson
mdodgson

Release 88 introduced an Early Access version of Advanced Search capability within Nexus IQ Server.

The Early Access feature is an opt-in feature which can only be enabled from within the UI. If you decide to try this feature and encounter any degradation in performance then it is advised to disable this feature and provide feedback.

Please provide any feedback on this feature by commenting on this post.

As this feature is early access, there are a number of caveats:

• The resulting dataset does not adhere to any configured permissions (all results are displayed) (implemented in version 94)
• To see new data in the results a re-index is required. This can either be automated using the provided REST API or manually from the UI.
• Keyword fields may subsequently change on different releases.

Download from here to try it out.

post by rsheldrake on Mar 16, 2020

@mdodgson It would be pretty cool to have a “saved” search capability i.e most used component, all level 10 components etc.

Also a top N previous searches drop down perhaps.

This is a really powerful feature and I really like the early access approach so other engineers can get a view and feed into its evolution.

post by rsheldrake on Mar 31, 2020

@mdodgson I changed the vulnerabilityStatus from Open to Confirmed on a vulnerability in a report and ran a search as below

applicationName:solid AND vulnerabilityStatus:Confirmed no results were returned until I ran a “reindex”. Is this by design?

post by mdodgson on Mar 31, 2020

It is currently by design.

post by mdodgson on May 18, 2020

UPDATE:

Release 91 introduced a query builder to aid in building your search queries. Clicking on any of the keywords will add the search term to your search query and mark the term as in use as indicated by the screenshot below:

Additionally, we added a collapsible section offering useful examples of search queries that are possible, these queries can be copied as seen into the search window.

post by mcupitt on Jun 8, 2020

It would be helpful to break out the component specific fields into their own group in the query builder. It took a bit to find them in the Security Vulnerability section. Thanks for the hard work! Its starting to look good!

post by joe.young.swqp on Jul 7, 2020

We’ve been playing around with this functionality some. We noticed after the update to v94, a few folks were no longer able to do searches. We did some testing today and found that only users in the Policy Admin role could do a search.

post by mdodgson on Jul 7, 2020

Hi Joe,

This was changed in the recent v94 release 2020 Release Notes.

post by dt3830806 on Jul 24, 2020

We’ve had some playing around with this app. Since the upgrade to v94 we found that a few people could no longer perform searches. Today we have carried out some tests and found that only users in the position of policy admin could do a search.

post by joe.young.swqp on Sep 2, 2020

Some feedback - don’t clear the search field after a search. It’s nice to see an error message if the query is incorrectly structured, but let us edit the existing query.

The query builder is a nice feature. I’d like to see more examples - for instance how to build a query that returns all applications under a specific organization, and lists the CVEs found in that application.

ex: organizationName:“MyOrg” AND applicationName:* AND vulnerabilityId:“CVE*”

I’d also like to be able to export the search results to a CSV or spreadsheet.

post by adamtsa on Sep 23, 2020

UPDATE:

Release 98 starts adding an incremental update of the search index that runs automatically when the application data is changed. Automatic indexing currently covers organizations, applications, application categories, component labels, policies, and security vulnerabilities found during policy evaluations. Automatic indexing only applies to data changes made whilst Advanced Search was enabled. In order for Advanced Search to index historical data, you must run re-index manually.