For hosts, ports, and vulnerabilities I think you might be able to make the query more efficient by using the regex to only find hosts with the matching note. Here is an example https://github.com/fishnetsecurity/Lair-Browser-Scripts/blob/master/iis_os_profiler.js#L13. Could get pretty complex.