quaxar-asm-assets

Get exposed assets from the S2W Quaxar ASM (Attack Surface Monitoring) service.

Syntax

quaxar-asm-assets [profile=STRING] [value=STRING] [severities=STRING] [ports=STRING] [softwares=STRING] [orgs=STRING] [query=STRING] [sorts=STRING] [duration=STRING] [from=STRING] [to=STRING] [pretty=BOOL]

Options

profile=STRING: Optional. QUAXAR connect profile code. If omitted, an available profile is used automatically.
value=STRING: Optional. IP address or domain name to search.
severities=STRING: Optional. Comma-separated severities to filter. Allowed values: EXTREME, MAJOR, MODERATE, MINOR.
ports=STRING: Optional. Comma-separated port numbers to filter. e.g. 80,443.
softwares=STRING: Optional. Comma-separated software names to filter.
orgs=STRING: Optional. Comma-separated customer organization names.
query=STRING: Optional. Search keyword.
sorts=STRING: Optional. Sort order. Allowed values: detected_time_desc, detected_time_asc, severity_desc, severity_asc, scanned_time_desc, scanned_time_asc.
duration=STRING: Optional. Scan only recent data. Use s(second), m(minute), h(hour), d(day), mon(month) time unit. e.g. 7d.
from=STRING: Optional. Start time of range in yyyyMMddHHmmss format. If you omit the time part, it is padded by zero.
to=STRING: Optional. End time of range in yyyyMMddHHmmss format. Cannot be used alone; specify with from or duration.
pretty=BOOL: Optional. Set t to enable pretty print with line breaks (default: f).

Output fields

Field	Type	Name	Description
profile	string	Connect profile	Profile name of QUAXAR
asset_id	string	Asset ID	Asset unique ID
asset_type	string	Asset type	DOMAIN or IP
ips	string	IPs	Newline-separated IP addresses
ports	string	Ports	Newline-separated detected ports
detected	date	Detected	Asset detection time
last_scanned	date	Last scanned	Asset last scanned time
severity	string	Severity	EXTREME, MAJOR, MODERATE or MINOR
critical_domain	boolean	Critical domain	Critical domain or not
domain_name	string	Domain name	Asset domain name
cloud_provider	string	Cloud provider	Cloud provider name
softwares	string	Softwares	Newline-separated detected softwares
seed_values	string	Seed values	Newline-separated matched seeds
customer_org	string	Customer org	Customer organization name
country	string	Country	Country of IP
city	string	City	City of IP
asn	string	ASN	AS number
isp	string	ISP	AS operator

Error codes

Parsing errors

Error message	Cause	Resolution
Specify valid Quaxar profile.	Invalid profile in the profile option	Specify a valid Quaxar connect profile code
No available Quaxar profile found.	No Quaxar connect profile registered	Register a Quaxar connect profile first
Invalid severities. Available severities are EXTREME, MAJOR, MODERATE, MINOR.	Disallowed severity value in severities	Use only allowed severity values
Invalid ports. Specify comma-separated port numbers.	Non-numeric value in ports	Specify numeric port numbers only
Invalid sorts. Available sorts are detected_time_desc, detected_time_asc, severity_desc, severity_asc, scanned_time_desc, scanned_time_asc.	Disallowed value in sorts	Use one of the allowed sort orders
Invalid duration. Use s(second), m(minute), h(hour), d(day), mon(month) time unit. (e.g. 7d)	Malformed duration	Use the specified time unit format
Specify from or duration option.	to specified without from or duration	Specify from or duration with to

Runtime errors

Error message	Cause	Resolution
quaxar asm api error: status=..., message=...	ASM API returned an error state	Check profile permission and ASM service

Description

quaxar-asm-assets is a source command that iterates the Quaxar ASM asset list from the first page to the last, emitting each asset as a row. Every row carries the connect profile name used for the query in the profile field. It is a read-only lookup and does not modify asset data.

List fields with multiple values such as ips, ports, softwares, and seed_values render differently based on the pretty option. With the default (pretty=f) they are rendered as a single-line JSON array like ["192.0.2.1","192.0.2.2"]; with pretty=t each value is separated by a line break.

The severities, ports, softwares, orgs, and query filters are combined with AND. Use duration or from/to to narrow the detection time range.

Examples

Example: Triage high-severity exposed assets first

Situation: An attack surface manager wants to review EXTREME and MAJOR assets first, sorted by descending severity.

quaxar-asm-assets severities=EXTREME,MAJOR sorts=severity_desc

Expected result:

asset_id	asset_type	severity	ips	detected
a1b2c3d4e5	IP	EXTREME	192.0.2.1	2026-07-20 14:22:37
f6g7h8i9j0	DOMAIN	MAJOR	192.0.2.2	2026-07-18 09:11:02

Interpretation: High-severity assets are sorted to the top. Use the asset_id with the quaxar-asm-asset command to look up per-asset certificate, port, and note details.