How do I query a custom entity by type?

JSONJ
JSONJ mod
in Security Engineering

We're having an issue where we cannot query by _type e.g. FIND <_type>

example: FIND ExampleCVE

results: 0

example: FIND Finding with _type = 'ExampleCVE'

results: many

Best Answer

  • JSONJ
    JSONJ mod
    Answer ✓
    The _type of an entity must be snake_case. The shorthand Find ExampleCVE basically equals Find * with _class = ‘ExampleCVE’ because ExampleCVE is in TitleCase.

    You’ll want to reupload the entities into J1 by rerunning the sync job and changing the type to example_cve for example. See the docs here: https://support.jupiterone.io/hc/en-us/articles/360022720434-J1QL-Query-Tutorial#part1simplerootquery

    ”... snake_case word tells the query to search for assets of that type (such as aws_account, aws_security_group, aws_internet_gateway, aws_instance, aws_iam_user, okta_user, user_endpoint)” 

This Month's Leaders

Categories