Group

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	A unique identifier that is a combination of GUID of selected Scan and Active Directory ObjectGUID of the object.
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	A special unique identifier that is a combination of the Name of the object and the Fully Qualified Domain Name of the Domain.
ObjectSid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Active Directory security identifier of object. (Ldap Display Name: objectSid)
Name	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Name of the specified object. (Ldap Display Name: name)
DistinguishedName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Active Directory distinguished name of the object. (Ldap Display Name: distinguishedName)
IsPrivileged	BOOLEAN	N/A (toggle)	Indicates that the object is Privileged.
IsAdmin	BOOLEAN	N/A (toggle)	Indicates that the object is Admin.
WhenChanged	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	The date when this object was last changed. (Ldap Display Name: whenChanged)
IsProtected	BOOLEAN	N/A (toggle)	Indicates that the object is a direct or nested member of the Protected Users group.
WhenCreated	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	The date when this object was created. (Ldap Display Name: whenCreated)
risk	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	The risk score of the object that calculated based on vulnerability counts and severities.
member_count	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	The total count of the direct member objects.
SAMAccountName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (Ldap Display Name: sAMAccountName)
Cn	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	The name that represents an object. Used to perform searches. (Ldap Display Name: cn)
SidHistory	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Contains previous SIDs used for the object if the object was moved from another domain. Whenever an object is moved from one domain to another, a new SID is created and that new SID becomes the objectSID. The previous SID is added to the sIDHistory property. (Ldap Display Name: sIDHistory)
GroupType	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Contains a set of flags that define the type and scope of a group object. (Ldap Display Name: https://learn.microsoft.com/en-us/windows/win32/adschema/a-grouptype)
SAMAccountType	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Specifies the account type of the security principal objects in Active Directory. (LDAP Display Name: sAMAccountType) (Field Reference)
first_degree_localadmin_count	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Indicates that the group has explicit local admin privilege on how many computers.
Description	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Description text to display for an object. (Ldap Display Name: description)
AdminCount	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (Ldap Display Name: adminCount)
IsLocalAdmin	BOOLEAN	N/A (toggle)	Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer.
ExposurePoint	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	ExposurePoint: A numerical value indicating the level of risk or exposure.
IsShadow	BOOLEAN	N/A (toggle)	Indicates that the object can compromise admin objects with at least one attack path.
AceAuditState	MULTI_LIST	IN	SACL audit coverage of the object’s permissions (ACEs): Full when every ACE is covered by a success audit rule, Partial when some are, None when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full.
Tier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Tier level Forestall assigned to the object: 0 (Tier 0), 1 (Tier 1) or 2 (Tier 2). Lower is more privileged.