Commands

Browse query commands across all apps.

Logpresso Forensic
forensic-extract-indicators Extract indicators of compromise from passing rows.
Logpresso Forensic
forensic-add-host-partition Add partition metadata to campaign host.
Logpresso Forensic
forensic-tag Tag one forensic record with a comment.
Logpresso Forensic
forensic-tags Get forensic tags.
Logpresso Forensic
forensic-untag Remove tags from one forensic record.
Logpresso Forensic
forensic-images List forensic evidence images of your company.
Akamai Guardicore
guardicore-untag-asset-batch Detach labels from Akamai Guardicore assets from input records. Input records must contain the guid (string, asset UUID) and key (string) fields, and the value (string) field when value-field is given. When neither value nor value-field is given, every value of the key is detached.
Akamai Guardicore
guardicore-delete-label-batch Delete labels from Akamai Guardicore by the IDs in input records. Deleting a label also detaches it from every asset carrying it. Input records must contain the guid (string, label UUID) field.
Akamai Guardicore
guardicore-set-asset-description-batch Set the free text description of Akamai Guardicore assets from input records. This is the note shown in the Comments box of the console asset detail. Input records must contain the guid (string, asset UUID) and description (string) fields. An empty description clears the note.
Akamai Guardicore
guardicore-tag-asset-batch Attach labels to Akamai Guardicore assets from input records. Input records must contain the guid (string, asset UUID), key (string) and value (string) fields.
Akamai Guardicore
guardicore-create-label-batch Create labels in Akamai Guardicore from input records. This defines the labels only and does not attach them to any asset. Input records must contain the key (string) and value (string) fields.
Akamai Guardicore
guardicore-remove-label-ip-batch Remove IP criteria listed in input records from Akamai Guardicore labels. Input records must contain the ip (string) field, and the key (string) and value (string) fields unless those are fixed by options. Each value is CIDR notation whose host bits are all zero (IPv4 needs a prefix of /8 or narrower), or a first-last range with no spaces.
Akamai Guardicore
guardicore-add-label-ip Add IP criteria to an Akamai Guardicore label, so every asset in the given subnets or ranges carries the label. Each value is CIDR notation whose host bits are all zero (IPv4 needs a prefix of /8 or narrower), or a first-last range with no spaces. The label is created on demand if it does not exist.
Akamai Guardicore
guardicore-add-label-ip-batch Add IP criteria from input records to Akamai Guardicore labels. Input records must contain the ip (string) field, and the key (string) and value (string) fields unless those are fixed by options. Each value is CIDR notation whose host bits are all zero (IPv4 needs a prefix of /8 or narrower), or a first-last range with no spaces. A label is created on demand if it does not exist.
Akamai Guardicore
guardicore-remove-label-ip Remove IP criteria from an Akamai Guardicore label. Only criteria matching the given subnets or ranges exactly are removed; the label itself and its other criteria stay. Each value is CIDR notation whose host bits are all zero (IPv4 needs a prefix of /8 or narrower), or a first-last range with no spaces.
Microsoft Azure
azure-resource-graph Run an Azure Resource Graph KQL query across the subscriptions of a connect profile.
Microsoft Defender for Cloud
defender-cloud-changes Lists posture transitions found between collection cycles of Microsoft Defender for Cloud data: newly found, resolved and reopened recommendations. Unchanged findings produce no rows.
Microsoft Defender for Cloud
defender-cloud-cve-findings Lists vulnerabilities collected from Microsoft Defender for Cloud, one row per affected resource, so each row names the CVE, the asset that carries it and the version that closes it.
Microsoft Defender for Cloud
defender-cloud-assessments Lists security recommendations collected from Microsoft Defender for Cloud, one row per recommendation per resource, ordered by Defender's own risk level.
Microsoft Defender for Cloud
defender-cloud-resources Lists the asset inventory collected from Microsoft Defender for Cloud, one row per resource, with its finding counts and the Defender plan that covers it.