Commands

Browse query commands across all apps.

Experimental
sonar-create-ticket Creates a ticket in a ticket repository, along with an event that carries the given fields.
Experimental
sonar-create-ticket-from-event Creates a ticket in a ticket repository from an existing event.
Experimental
sonar-investigate-result Returns the rows saved in an investigation result.
Experimental
sonar-add-pattern Adds a pattern to a pattern group.
Experimental
sonar-investigate Runs a query and saves its results to a ticket as an investigation result.
Experimental
sonar-remove-address-object Removes an IP address from an address group.
Experimental
sonar-add-address-object Adds an IP address to an address group.
PHP2Shell Scanner
php2shell-add-target-batch Registers the URL in each input row as a scan target and adds the result to the row. A target already registered with the same host, port and path is skipped. Requires administrator permission.
PHP2Shell Scanner
php2shell-delete-target-batch Deletes the scan target matching the URL in each input row, together with its scan result history. Requires administrator permission.
PHP2Shell Scanner
php2shell-results Lists the stored scan result history of the caller's company, newest first, one row per scanned target. Requires a logged-in session.
PHP2Shell Scanner
php2shell-targets Lists the registered scan targets of the caller's company with their latest verdict. Requires a logged-in session.
PHP2Shell Scanner
php2shell-scan-batch Reads a URL from each input row, scans it for the PHP2Shell vulnerability and adds the verdict to the row. The result is not stored; to record results, scan from the Scan Targets screen. Cancelling the query stops the request in flight at once.
PHP2Shell Scanner
php2shell-scan Scans one URL for the PHP2Shell vulnerability (CVE-2026-109618/109619) and returns one row with the verdict. A scan sends up to about 29 MiB to the target, so run it only against assets you are authorized to test. Cancelling the query stops the request in flight at once.
Google Cloud
gcp-projects Search projects using Cloud Resource Manager API.
Google Cloud
gcp-assets Search resources under Google Cloud projects, folders or organizations using Cloud Asset Inventory API.
Google Cloud
gcp-check-permissions Check whether the service account has permissions required by Google Cloud commands on the scope.
Google Cloud
gcp-iam-policies Search Google Cloud IAM policies using Cloud Asset Inventory API and output one row per role and member.
Logpresso Forensic
forensic-extract-indicators Extract indicators of compromise from passing rows.
Logpresso Forensic
forensic-add-host-partition Add partition metadata to campaign host.
Logpresso Forensic
forensic-tag Tag one forensic record with a comment.