Query Commands
The query commands inspect text or log records with Starfort. Use them to check whether logs still carry personal data, or to see verdicts for a body of data before applying the guardrail.
| Command | Kind | Purpose |
|---|---|---|
starfort-guard | Driver | Inspect one text |
starfort-guard-batch | Pipe | Inspect the text field of each input record |
Both commands may omit profile when only one AIM Starfort connect profile is available to you. With more than one, specify it with profile.
Inspecting a text - starfort-guard
Inspects one text and emits one result record.
The record carries profile, text and the common output fields below.
Inspecting records - starfort-guard-batch
Inspects the text field of each input record as it streams through, and passes the record on with the result fields added. To inspect another field, copy it into text with eval.
- A record with an empty
textpasses through without inspection - A field of the input record with the same name as an output field (such as
actionin firewall logs) is overwritten by the result - Each record is one API call. Narrow a large table by period or condition before piping it
Common output fields
| Field | Description |
|---|---|
action | PASS, MASK or BLOCK. Null when no verdict was received |
processed_content | The masked text on MASK |
detected_items | Detections (policy_name, rule_name, mask_word, matched_text, alert_message, action) |
mask_mappings | Mask mappings (seq, original_text, masked_text, mask_word, mode) |
request_id | Starfort's X-Request-ID |
http_status | HTTP status |
latency_ms | Call latency in milliseconds |
error | Error code and message when no verdict was received |
A record with error has a null action. That is not a pass, so filter on the verdict itself, as in search action == "PASS".
For option and field details, see the command manuals for starfort-guard and starfort-guard-batch.