Documentation Index

Fetch the complete documentation index at: https://help.nucleussec.com/llms.txt

Use this file to discover all available pages before exploring further.

Available Datasets (NQL)

  • 2 minute(s) read
Prev Next

Overview

This page is a reference for the datasets you can query with NQL (Nucleus Query Language). Each section below covers one dataset including when it is available to you, the query that runs by default, and the fields you can select, filter, sort, and aggregate on.

In Fields tables, the Values column only applies to fields with a fixed set of values. The Values column will be blank for the following scenarios:

  • Boolean types: valid values are always “Yes” or “No”.

  • Number, date, free-form text types: not constrained to a specific set of values.

  • Dynamic fields: fields like Asset Groups or scanner-specific asset metadata that varies by organization.

Which datasets and fields are available to you in Nucleus depends on your organization's settings, enabled modules, and your permissions, as noted under each dataset. For NQL syntax and language help, see the Nucleus Query Language (NQL) reference page.

Available Datasets:

Findings (findings)

Access / Scope Prerequisites

Generally available to all organizations.

Default query

SELECT finding_name, finding_source, host_last_seen_date, host_name, asset_name, severity, finding_discovered 
FROM findings 
ORDER BY finding_name ASC, severity DESC

Fields

Field ID

Label

Type

Sortable

Values

age

Age

number

Yes

asset_business_owner_team

Business Owner Team

string

Yes

asset_eol_date

Asset EOL Date

string

Yes

asset_group

Asset Groups

list (array)

No

asset_id

Asset ID

number

Yes

asset_info

Asset Info

object
(dynamic fields)

Yes

asset_name

Asset

string

Yes

asset_source

Asset Source

string

Yes

asset_support_team

Support Team

string

Yes

asset_type

Asset Type

string

Yes

assigned_team

Assigned Team

string

Yes

business_criticality

Business Criticality

string

Yes

Critical, High, Moderate, Low

cisa_kev_exists

CISA KEV Exists

boolean

Yes

cisa_adp_ssvc_exploitation

CISA ADP SSVC Exploitation

string

Yes

None, Public PoC, Active

cisa_adp_ssvc_automatable

CISA ADP SSVC Automatable

boolean

Yes

cisa_adp_ssvc_technical_impact

CISA ADP SSVC Technical Impact

string

Yes

Partial, Total

compliance_scope

Compliance Scope

string

Yes

In-Scope, Out-of-Scope

cves

CVEs

string

Yes

cve_count

CVE Count

number

Yes

cve_published_date

CVE Published Date

datetime

Yes

data_sensitivity

Data Sensitivity

string

Yes

Critical, High, Moderate, Low

due_date

Due Date

date

Yes

exploitable

Exploitable

boolean

Yes

finding_discovered

Finding Discovered

datetime

Yes

finding_last_seen

Last Seen

datetime

Yes

finding_name

Finding Name

string

Yes

finding_number

Finding Number

string

Yes

finding_package

Package

string

Yes

finding_package_version

Package Version

string

Yes

finding_package_fix_versions

Fix Version

string

Yes

finding_path

Path

string

Yes

finding_risk_score

VPS / Finding Risk Score

number

Yes

finding_source

Finding Source

string

Yes

finding_state

State

string

Yes

finding_status

Finding Status

string

Yes

Active, Exception Requested, Fixed, In Progress, Potential, Waiting for 3rd Party, Waiting for Verification

(active states only)

finding_type

Finding Type

list (array)

No

host_last_seen_date

Asset Last Seen

datetime

Yes

host_name

Host Name

string

Yes

ip_address

IP Address

string

Yes

network_exposure

Network Exposure

string

Yes

nucleus_description

Description

string

Yes

nucleus_ease_of_exploitation

Ease of Exploitation

string

Yes

Very Easy, Easy, Moderate, Hard, Very Hard, Unknown

nucleus_expert_analysis

Expert Analysis

string

Yes

nucleus_exploit_available

Exploit Available

boolean

Yes

nucleus_exploit_weaponized

Exploit Weaponized

boolean

Yes

nucleus_exploitation_consequence

Exploitation Consequence

string

Yes

nucleus_exploited

Exploited

boolean

Yes

nucleus_exploited_by_malware

Exploited by Malware

boolean

Yes

nucleus_exploited_by_ransomware

Exploited by Ransomware

boolean

Yes

nucleus_fix_available

Fix Available

boolean

Yes

nucleus_impacts_ot

Impacts OT

boolean

Yes

nucleus_likely_to_be_exploited

Likely to be Exploited

boolean

Yes

nucleus_patch_available

Patch Available

boolean

Yes

nucleus_private_exploit_available

Private Exploit Available

boolean

Yes

nucleus_public_exploit_available

Public Exploit Available

boolean

Yes

nucleus_remote_exploitation

Remote Exploitation

boolean

Yes

nucleus_threat_rating

Threat

string

Yes

Existential, Critical, High, Medium, Low

nucleus_vuln_type

Vulnerability Type

list (array)

No

nucleus_widely_exploited

Widely Exploited

boolean

Yes

nucleus_zero_day

Zero Day

boolean

Yes

nucleus_zero_day_previously

Zero Day Previously

boolean

Yes

project_id

Project ID

number

Yes

project_name

Project Name

string

Yes

severity

Severity

string

Yes

Critical, High, Medium, Low, Informational

source_severity

Source Severity

string

Yes

Assets (assets)

Access / Scope Prerequisites

Generally available to all organizations.

In Project > Explore > All Findings, requires the View Assets (projectassets-read) permission.

In Global > Explore, access is scoped to the projects the user has access to.

Default query

SELECT asset_name, asset_type, asset_source, asset_risk_score 
FROM assets 
WHERE is_active = "Yes" 
ORDER BY asset_risk_score DESC

Fields

Field ID

Label

Type

Sortable

Values

app_branch

Branch

string

Yes

app_language

Language

string

Yes

app_repo_type

Repository Type

string

Yes

app_repo_url

Repository URL

string

Yes

app_revision

Revision

string

Yes

app_version

Application Version

string

Yes

asset_base_risk_score

Asset Base Risk Score

number

Yes

asset_group

Asset Groups

list   (array)

No

asset_id

Asset ID

number

Yes

asset_last_mitigated_finding_date

Last Mitigated Date

datetime

Yes

asset_name

Asset Name

string

Yes

asset_next_sla_date

Next SLA Date

datetime

Yes

asset_risk_score

Asset Risk Score

number

Yes

asset_source

Asset Source

string

Yes

asset_subtype

Asset Subtype

string

Yes

asset_type

Asset Type

string

Yes

API Gateway, Access Control Policy, Access Entitlement, Access Key, Application, Big Data Cluster, Bucket, CDN, Cloud Account, Cloud Log Configuration, Cloud Resources Deployment, Configuration Parameter, Container Cluster, Container Image, Container Workload Definition, Container Workload, DNS Zone, Data Analytics Environment, Database, Encryption Key, File Storage Service, Firewall, Gateway, Host Group, Host Image, Host, Load Balancer, Managed Certificate, Messaging Service, Network Interface, Private Endpoint, Private Link, Region, Registered Domain, Secret, Secrets Manager, Serverless, Service Account, Service Rule, Subnet, User Account, User Group, Virtual Network, Volume Snapshot, Volume

business_criticality

Business Criticality

string

Yes

Critical, High, Moderate, Low

business_owner_team

Business Owner Team

string

Yes

cloud_account_id

Account ID

string

Yes

cloud_provider

Cloud Provider

string

Yes

cloud_region

Region

string

Yes

cloud_resource_id

Resource ID

string

Yes

cloud_resource_name

Resource Name

string

Yes

cloud_unique_id

Unique ID

string

Yes

compliance_scope

Compliance Scope

string

Yes

In-Scope, Out-of-Scope

cpu_architecture

CPU Architecture

string

Yes

cpu_features

CPU Features

string

Yes

cpu_variant

CPU Variant

string

Yes

data_sensitivity

Data Sensitivity

string

Yes

Critical, High, Moderate, Low

description

Description

string

Yes

domain_name

Domain Name

string

Yes

image_config

Image Config

string

No

image_digest

Digest

string

Yes

image_distro

Image Distro

string

Yes

image_id

Image ID

string

Yes

image_manifest

Image Manifest

string

No

image_os

Image OS

string

Yes

image_registry

Image Registry

string

Yes

image_repo

Repository

string

Yes

image_secondary_registries

Image Secondary Registries

string

Yes

image_tags

Image   Tags

string

Yes

inactive_date

Inactive   Date

datetime

Yes

ip_address

IP Address

string

Yes

is_active

Is Active

boolean

Yes

last_seen

Last Seen

datetime

Yes

license_type

License Type

string

Yes

Compute, Non-Compute

location

Location

string

Yes

mac_address

MAC Address

string

Yes

network_exposure

Network Exposure

string

Yes

Internal, External

operating_system

Operating System

string

Yes

operating_system_version

OS Version

string

Yes

project_id

Project ID

number

Yes

project_name

Project Name

string

Yes

support_team

Support Team

string

Yes