Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Using J1 Metadata - AskJ1 Community
<main> <article class="userContent"> <p>JupiterOne adds metadata properties to all data in the J1 system, regardless of how the data was created. All metadata properties begin with an underscore <code class="code codeInline" spellcheck="false" tabindex="0">_</code> and are visible when you click on any asset in J1 Assets. The asset properties drawer opens, and the Metadata tab displays all the metadata for that asset.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/KSCLO4N5ARJW/asset-drawer.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p>You can query metadata properties like any other property in J1QL or via the API. Metadata properties include:</p> <table><thead><tr><th>Property</th> <th>Definition</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_accountId</code></td> <td>JupiterOne account ID associated with the asset.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_beginOn</code></td> <td>Last time the asset was updated in JupiterOne in millisecond epoch time.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_class</code></td> <td>String value of the JupiterOne class of the asset (such as 'DataStore').</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_createdOn</code></td> <td>First time the asset was created in JupiterOne (not the source) in millisecond epoch time.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_deleted</code></td> <td>Boolean value if the asset is in a deleted state or not (such as false).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_endOn</code></td> <td>Time the asset was deleted in JupiterOne (not the source) in millisecond epoch time (is null/undefined if deleted = false).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_fromEntityId</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">_id</code> of the asset with which the "from" relationship exists.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_fromEntityKey</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">_key</code> of the asset with which the "from" relationship exists.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_id</code></td> <td>UUID value for the asset (string).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationClass</code>*</td> <td>If the asset came from an integration, this property is an array of string values containing the tags attributed to the integration (such as ['CSP', 'Infrastructure'']).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationDefinitionId</code>*</td> <td>UUID for the specific JupiterOne integration. Every integration, such as AWS, has a unique <code class="code codeInline" spellcheck="false" tabindex="0">integrationDefinitionId</code> (string).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationInstanceId</code>*</td> <td>UUID for the specific integration configuration the asset came from in your environment (string).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationName</code>*</td> <td>Your choice of common name (string) for the integration configuration the asset came from (such as 'Prod-US-East-1 AWS Environment'), and maps 1:1 with a unique <code class="code codeInline" spellcheck="false" tabindex="0">integrationDefinitionId</code>.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_integrationType</code>*</td> <td>JupiterOne internal development name (string, all lowercase, no spaces) for an integration (such as 'aws', 'azure', 'google_cloud').</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_key</code></td> <td>Locally unique value (string) for the asset within the <code class="code codeInline" spellcheck="false" tabindex="0">_scope</code> of the integration or API ingestion job it came from. These properties are set by JupiterOne for integrations, and by you for custom uploads. Two assets can have the same<code class="code codeInline" spellcheck="false" tabindex="0">_key</code> or the same <code class="code codeInline" spellcheck="false" tabindex="0">_scope</code>, but not both.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_scope</code></td> <td>Value (string) to define a group of assets that are ingested together via an integration or API (such as all entities uploaded via API in the same synchronization job would have the same user-defined <code class="code codeInline" spellcheck="false" tabindex="0">_scope</code> value).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_source</code></td> <td>Can be one of three values ('integration-managed', 'system-mapper', 'api') (string).</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_toEntityId</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">_id</code> of the asset with which the "to" relationship exists.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_toEntityKey</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">_key</code> of the asset with which the "to" relationship exists.</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_type</code></td> <td>Value of the JupiterOne type of asset (string) (such as 'aws_s3_bucket').</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">_version</code></td> <td>Value of the number (integer) of times the asset has been updated in JupiterOne (such as 59).</td> </tr></tbody></table><p>*All metadata properties beginning with _integration are null/undefined if the asset did not come from an integration.</p> </article> </main>
.png)