I created an Asset view dashboard for the following query.
- Hosts Scanned in last 3 days
- Severity 3
- Types - Vulnerability
- QID - specific to 105484
So anytime I run the Query "tags.name:XYZ and lastVmScanDate:[now-3d .. now-1s] and vulnerabilities.vulnerability: (types: VULNERABILITY and not qid:105484)". It always gives me the number of hosts affected by 105484, even though i only want to see hosts that are not affected by 105484.
If someone can tell me is my string query wrong or is there an error in detection.