Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Query Resources with/without Specific Tags - AskJ1 Community
<main> <article class="userContent"> <p>Tagging is highly recommended for resources in cloud environments such as AWS, Azure, and GCP. For example, it is common to use tags to track <code class="code codeInline" spellcheck="false" tabindex="0">cost-center</code> or <code class="code codeInline" spellcheck="false" tabindex="0">project</code>. It is recommended that you assign <code class="code codeInline" spellcheck="false" tabindex="0">classification</code> tag to all databases and data stores, such as buckets, blobs, disks.</p> <h2 data-id="query-resources-with-tags">Query Resources with Tags</h2> <p>Use this example query:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Host|Function|DataStore) with [tag.cost-center] = undefined </pre> <p><strong>For tags with special characters such as <code class="code codeInline" spellcheck="false" tabindex="0">-</code>, use <code class="code codeInline" spellcheck="false" tabindex="0">[ ]</code> around the tag property:</strong></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find * with _integrationType = 'aws' and [tag.cost-center] = undefined </pre> <p><strong>Why not just use <code class="code codeInline" spellcheck="false" tabindex="0">Find *</code> to cover everything?</strong></p> <p><code class="code codeInline" spellcheck="false" tabindex="0">Find *</code> searches across all resources, including all integrations, mapped entities, and those pushed via API or created via the UI. This query returns <em>many</em> false positives, and makes the query slow.</p> <p>**More fine tuning to reduce noise:*</p> <p>Many entities such as <code class="code codeInline" spellcheck="false" tabindex="0">Account</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Service</code>, <code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code> such as<code class="code codeInline" spellcheck="false" tabindex="0">aws_iam_policy</code> are likely to not have these custom tags applied, so even querying with <code class="code codeInline" spellcheck="false" tabindex="0">_integrationType = 'aws'</code> generates some noise. However, it is painful to write a query for each resource type -- there could be 100 of them!</p> <p>This is where leveraging the <code class="code codeInline" spellcheck="false" tabindex="0">class</code> and combination syntax in the query becomes extremely helpful. For example:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find (Host|Function|DataStore) with [tag.cost-center] = undefined </pre> <p>Still a single query, without the noise. The three classes <code class="code codeInline" spellcheck="false" tabindex="0">Host</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Function</code>, and <code class="code codeInline" spellcheck="false" tabindex="0">DataStore</code> include a couple dozens of types, and covers resources you are not using today but may start using in the future that are of those classes. You can add additional classes to the query as needed.</p> <h2 data-id="query-resources-without-tags">Query Resources without Tags</h2> <p><strong>To find resources that do <em>not</em> have a certain tag, do the following:</strong></p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find * with _integrationType = 'aws' and tag.project = undefined </pre> <p>From the above, <code class="code codeInline" spellcheck="false" tabindex="0">undefined</code> means the property does not exist on the entity. And <code class="code codeInline" spellcheck="false" tabindex="0">_integrationType = 'aws'</code> filters only resources from AWS. Change it to <code class="code codeInline" spellcheck="false" tabindex="0">azure</code> or something else as appropriate.</p> <h2 data-id="bulk-actions-from-the-ui">Bulk Actions from the UI</h2> <p>J1 enables you to bulk set tags from the UI for any resources that you find that do not have the tags or owners. From your query results, select all and click <strong>Set Owner</strong> or <strong>Set Tags</strong>.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/DYHJBY1BMLUT/bulk-action.png" alt="" class="embedImage-img importedEmbed-img"></img></p> </article> </main>
.png)