Skip to main content

Basic queries

These examples, and same with all packaged queries provided in the JupiterOne web apps, are constructed in a way to de-emphasize the query keywords (they are case insensitive) but rather to highlight the relationships—the operational context and significance of each query.

Simple Examples​

Find any entity that is unencrypted

FIND * WITH encrypted = false

Find all entities of class DataStore that are unencrypted

FIND DataStore WITH encrypted = false

Find all entities of type aws_ebs_volume that are unencrypted

FIND aws_ebs_volume WITH encrypted = false

Query with relationships​

Return just the Firewall entities that protects public-facing hosts

FIND Firewall
  THAT PROTECTS Host WITH public = true

Return Firewall and Host entities that matched query

FIND Firewall AS f
  THAT PROTECTS Host WITH public = true AS h
RETURN f, h

Return all the entities and relationships that were traversed as a tree

FIND Firewall
  THAT PROTECTS Host WITH public = true
RETURN tree

Full-text search​

Find any and all entities with "127.0.0.1" in some property value

FIND "127.0.0.1"

The FIND keyword is optional

"127.0.0.1"

Find all hosts that have "127.0.0.1" in some property value

FIND "127.0.0.1" WITH _class='Host'
What full-text search covers

Full-text search is a case-insensitive "contains" match against the human-readable property values on an entity. Three kinds of value are deliberately not indexed:

  • Serialized JSON documents — properties whose value is a JSON object or array, such as policyDocument, ingressRules, or parameters.
  • Booleans — true and false.
  • Epoch-millisecond timestamps — for example 1789430400000. Dates that an integration also emits as a formatted string remain searchable through that string.

These properties are unchanged on the entity and are still returned in results. To search inside them, filter on the property directly with the ~= (contains) operator:

FIND aws_iam_role WITH policyDocument ~= "s3:getobject"

See What's new in Asset Data for the full detail, and regular expressions for more advanced matching.

More complex queries​

Find critical data stored outside of production environments.

This assumes you have the appropriate tags (Classification and Production) on your entities.

FIND DataStore WITH tag.Classification = "critical"
  THAT HAS * WITH tag.Production = "false"

Find all users and their devices without the required endpoint protection agent installed:

FIND Person
  THAT HAS Device
  THAT !PROTECTS HostAgent

Find incorrectly tagged resources in AWS:

FIND * AS r
  THAT RELATES TO Service
  THAT RELATES TO aws_account
WHERE r.tag.AccountName != r.tag.Environment

If your users sign on to AWS via single sign on, you can find out who has access to those AWS accounts via SSO:

FIND User AS u
  THAT ASSIGNED Application AS app
  THAT CONNECTS aws_account AS aws
RETURN u.displayName as User, app.tag.AccountName as IdP, app.displayName as ssoApplication,
  app.signOnMode as signOnMode, aws.name as awsAccount

Contents