quaxar-asm-seed-remove-batch

Remove seeds registered in the S2W Quaxar ASM service in bulk using the seed ID field of input rows.

Syntax

quaxar-asm-seed-remove-batch profile=STRING

Options

profile=STRING: Required. QUAXAR connect profile code. This is a write operation, so exactly one profile must be specified.

Input fields

Field	Type	Required	Description
seed_id	string	Y	Unique ID of the seed to remove. Can be replaced by the seedId field
seedId	string	N	Fallback field used when seed_id is absent

Output fields

Field	Type	Name	Description
result	string	Result	OK when removed
_error	string	Error	Failure reason when removal fails (absent on success)

Error codes

Parsing errors

Error message	Cause	Resolution
Specify valid Quaxar profile.	Missing profile option	Specify a profile code in profile
Batch command requires exactly one profile.	More than one profile specified	Specify exactly one profile
No available Quaxar profile found.	No Quaxar connect profile registered	Register a Quaxar connect profile first

Runtime errors

Per-row failures do not stop the pipeline; they are flowed to the _error field of the affected row.

Error message	Cause	Resolution
seed_id field not found	Input row has no seed_id/seedId	Fill in the seed_id field in the input
quaxar asm api error: status=..., message=...	ASM API returned an error to the remove request	Check seed ID validity and profile permission

Description

Caution

This is a hard-to-reverse removal command. Removing a seed switches its state to REMOVED, and the related assets collected via that seed become Hidden. Before running, be sure the input pipeline contains only the seeds you intend to remove.

quaxar-asm-seed-remove-batch is a batch command that reads the seed_id (or seedId if absent) field of each incoming row and removes (switches to REMOVED) the corresponding seed. The seed_id comes from the output of the quaxar-asm-seeds command. If the field is missing, that row is not removed; instead the reason is placed in the _error field and the row is passed through. A single row failure does not stop the whole pipeline.

Because it is a write operation, exactly one profile must be specified.

Examples

Example: Selectively remove specific seeds from a query result

Situation: You want to select seeds that no longer need monitoring from a query result and remove them in bulk.

quaxar-asm-seeds state=MONITORING
| search seed_type == "DOMAIN" and value == "example.com"
| quaxar-asm-seed-remove-batch profile=my_profile

Expected result:

seed_id	value	result
seed-1	example.com	OK

Interpretation: A seed with result OK has been removed, its state switched to REMOVED, and its related assets set to Hidden. A row with the _error field populated failed to remove; verify the seed ID validity and retry.